* The CSIBlockVolume feature gate is now beta, and defaults to enabled. ([#74909](https://github.com/kubernetes/kubernetes/pull/74909), [@bswartz](https://github.com/bswartz))

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \
    --name opa \

pkg math/bits (netbsd-arm64), const UintSize = 64
pkg math/bits (netbsd-arm64-cgo), const UintSize = 64
pkg math/bits (openbsd-386), const UintSize = 32
pkg math/bits (openbsd-386-cgo), const UintSize = 32
pkg math/bits (openbsd-amd64), const UintSize = 64
pkg math/bits (openbsd-amd64-cgo), const UintSize = 64
pkg math/bits (windows-386), const UintSize = 32
pkg math/bits (windows-amd64), const UintSize = 64

//go:build freebsd || openbsd || netbsd
// +build freebsd openbsd netbsd

// Copyright (c) 2015-2021 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//

 * https://tersesystems.com/blog/2018/09/08/keymanagers-and-keystores/
 *
 * Install OpenSC separately. On a mac `brew cast install opensc`.
 */
@SuppressSignatureCheck
class YubikeyClientAuth {
  fun run() {
    // The typical PKCS11 slot, may vary with different hardware.
    val slot = 0

    val config = "--name=OpenSC\nlibrary=/Library/OpenSC/lib/opensc-pkcs11.so\nslot=$slot\n"

    // May fail with ProviderException with root cause like

   * {@link java.util.Collections#checkedCollection(java.util.Collection, Class)} can suppress it
   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to

   * {@link java.util.Collections#checkedCollection(java.util.Collection, Class)} can suppress it
   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to

    """
    METHOD = 'assume-role-client-grants'
    CANONICAL_NAME = 'AssumeRoleClientGrants'

    def __init__(self, cid, csec,
                 idp_ep='http://localhost:8080/auth/realms/minio/protocol/openid-connect/token',
                 sts_ep='http://localhost:9000'):
        self.cid = cid
        self.csec = csec
        self.idp_ep = idp_ep
        self.sts_ep = sts_ep

import java.util.Collection;
import java.util.List;
import java.util.Map;
import junit.framework.Test;

/**
 * Tests the {@link Map} implementations of {@link java.util}, suppressing tests that trip known
 * bugs in OpenJDK 6 or higher.
 *
 * @author Kevin Bourrillion
 */
// TODO(cpovirk): consider renaming this class in light of our now running it under newer JDKs.
@AndroidIncompatible // test-suite builders

pkg syscall (openbsd-386), func SetBpfHeadercmpl //deprecated
pkg syscall (openbsd-386), func SetBpfImmediate //deprecated
pkg syscall (openbsd-386), func SetBpfInterface //deprecated
pkg syscall (openbsd-386), func SetBpfPromisc //deprecated
pkg syscall (openbsd-386), func SetBpfTimeout //deprecated
pkg syscall (openbsd-386), func StringSlicePtr //deprecated