w {
    is_token_valid
    action_allowed
}

is_token_valid {
  token.valid
  now := time.now_ns() / 1000000000
  token.payload.nbf &lt;= now
  now &lt; token.payload.exp
}

action_allowed {
  startswith(http_request.path, base64url.decode(token.payload.path))
}
EOF
$ kubectl create secret generic opa-policy --from-file policy.rego
</code></pre><h3 id=deploy-httpbin-and-opa>Deploy httpbin and OPA</h3><p>Enable the sidecar injection:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ k