[viethqb]

Summary

These are the docs for egret-data/platform#844, which turns OPA on by default (SP2b Task 26).

• Trino on OPA:
  • [governance.opa] enabled now defaults to true, and OPA also needs ranger.enabled, which is off by default;
  • how to turn OPA off;
  • the new refusal text, which names both keys;
  • the tag-service warning;
  • the shared-tag-service refresh latency.
• Configuration keys: the new default, and when listen and engine_url are checked.
• Kubernetes:
  • opa.enabled defaults to true;
  • the OPA port, Service port and NetworkPolicy rule render only when both opa.enabled and ranger.enabled are on.
• Upgrade:
  • OPA is on by default, and profiles stay on Ranger;
  • a non-Helm install with Ranger on can fail to start after the upgrade (port 8082 taken, a port collision, a stale listen or engine_url, or an underivable URL), and how to fix it;
  • the earlier release notes are annotated.

KI-352, KI-353 and KI-354 already exist and are unchanged. npm run build passes.

🤖 Generated with Claude Code