Implement Policy Enforcer Plugin

- Added a new Policy Enforcer plugin to evaluate incoming messages against OPA policies.
- Configurable via YAML with options for policy sources, actions, and query.
- Integrated into existing configuration files for BAP and BPP.
- Updated related tests and documentation for the new functionality.
- Enhanced plugin manager to support Policy Enforcer instantiation.
This commit is contained in:
Ayush Rawat
2026-02-26 17:46:52 +05:30
parent fe541227b9
commit 3617c9b4a6
22 changed files with 1341 additions and 39 deletions

View File

@@ -35,6 +35,7 @@ type stdHandler struct {
registry definition.RegistryLookup
km definition.KeyManager
schemaValidator definition.SchemaValidator
policyEnforcer definition.PolicyEnforcer
router definition.Router
publisher definition.Publisher
transportWrapper definition.TransportWrapper
@@ -318,6 +319,9 @@ func (h *stdHandler) initPlugins(ctx context.Context, mgr PluginManager, cfg *Pl
if h.transportWrapper, err = loadPlugin(ctx, "TransportWrapper", cfg.TransportWrapper, mgr.TransportWrapper); err != nil {
return err
}
if h.policyEnforcer, err = loadPlugin(ctx, "PolicyEnforcer", cfg.PolicyEnforcer, mgr.PolicyEnforcer); err != nil {
return err
}
log.Debugf(ctx, "All required plugins successfully loaded for stdHandler")
return nil
@@ -350,6 +354,8 @@ func (h *stdHandler) initSteps(ctx context.Context, mgr PluginManager, cfg *Conf
s, err = newValidateSchemaStep(h.schemaValidator)
case "addRoute":
s, err = newAddRouteStep(h.router)
case "enforcePolicy":
s, err = newEnforcePolicyStep(h.policyEnforcer)
default:
if customStep, exists := steps[step]; exists {
s = customStep