OPA custom health check

[itayhac]

Hi Team

I am working on implementing custom health checks in Open Policy Agent following the Custom Health Checks documentation.

While the endpoints /health/live and /health/ready route correctly to my policy, I am encountering two issues:

The expected input context (e.g., input.plugins_ready, input.plugin_state) is missing or undefined during evaluation.

Document/data store state (data...) does not seem accessible within the system.health package context.

Context & Goals
Our main objective is to reduce the blast radius of bundle synchronization failures. Currently, a single corrupted or unreachable bundle can fail the readiness check and disrupt the entire instance.

We are trying to construct a /health/ready check that evaluates:

Data Accessibility: Validates that key data paths (e.g., data.my_bundle) are fully loaded and queryable.

Threshold-Based Health: Marks the bundle plugin as ready as long as the number of degraded/failed bundles remains below a threshold
X
, rather than requiring
100
compliance.

Code Snippet

default live := true

default ready := false

ready if {
    input.plugins_ready
    input.plugin_state.bundle == "OK"
}

as suggested in the custom-health-checks section, i would like to further extend it to support data access and bundle status.

Questions

Debug / Configuration: Is there a specific configuration or feature flag required to expose input and data storage to the system.health package?

Implementation Strategy: What is the recommended way to achieve this objective?
Should we build a custom OPA plugin in Go (using OPA as a SDK library to register a custom HTTP handler and query internal bundle managers/storage directly)?
Or can this be reliably handled natively using a Rego custom health check?

Thanks in advance for any insights!