[viethqb]

Summary

These are the user docs for egret-data/platform#843. That PR moves egret's OPA decision surface off API port 8080 onto its own listener, which only engines can reach.

Pages

• platform/data-governance/engines-and-policy/trino-on-opa.md:
  • the OPA port and how the engine URL is derived;
  • the start-up re-apply, which runs in the background, and the query outage until each coordinator restarts;
  • external engines must re-install their plugin files;
  • the NetworkPolicy.
• platform/reference/configuration-keys.md: governance.opa.listen and governance.opa.engine_url, which are checked only while OPA is on.
• platform/deploy-operate/kubernetes.md: opa.enabled, opa.port, opa.extraFrom, and the egret-ingress policy. This describes what the chart renders; it was not run on a live cluster.
• platform/deploy-operate/upgrade.md:
  • provisioned OPA engines are re-applied at start;
  • queries are refused until then, so upgrade in a maintenance window;
  • external engines must re-install their plugin files;
  • firewalls must allow the OPA port from engines.

npm run build passes, for en and vi.

🤖 Generated with Claude Code