OPA-Envoy is a plugin that enforces Open Policy Agent policies with Envoy by implementing the Envoy External Authorization API.
The plugin solves the problem of applying fine-grained, context-aware access control policies to traffic flowing through Envoy proxies without requiring changes to microservices themselves. It extends OPA with a gRPC server that receives authorization requests from Envoy's external authorization filter, evaluates policies against those requests, and returns authorization decisions. This approach allows policies to be centralized and managed separately from application code.
The tool suits organizations running Envoy-based service meshes like Istio or Gloo Edge that need to enforce consistent authorization policies across their infrastructure. It is particularly valuable when you want policy decisions to be independent of application logic and when you need to apply the same authorization rules across multiple services. The plugin integrates directly into Envoy's authorization flow, making it suitable for cloud-native deployments where sidecar proxies are already in use.
The project maintains active issue management through GitHub Issues for feature requests and bug reports. Documentation and performance benchmarks are available in the OPA project's official documentation. The repository includes practical examples for Istio and Gloo Edge deployments, along with a quick-start guide using Kubernetes and Minikube that demonstrates policy enforcement with sample applications. The codebase is written in Go and includes configuration examples showing how to deploy the plugin as a sidecar container and load policies via bundles from remote HTTP servers for production use.
