Opa microservice authorization
- 1. Anders Eknert, Developer Advocate, Bisnode Decoupled policy management and enforcement at scale Microservice authorization with Open Policy Agent
- 2. Open Policy Agent (OPA) • General purpose policy engine. • Decouples (most commonly, authorization) policies from application logic. • Provides a unified way of dealing with policies across the stack, independent to othertechnology choices made. • Use cases ranging from kubernetes admission control, microservice authorization and data sources, to CI/CD pipeline policies. • Vibrant Open Source community. • Commercial backer(Styra).
- 3. Running OPA – “the distributed parts” OPA canrunina numberofconfigurations,dependingonusecase • Standaloneserver • Sidecarcontainerinside pods • Go library • WASM
- 4. https://www.openpolicyagent.org/docs/latest/policy- language/ “Rego was inspired by Datalog, which is awell understood, decades oldquery language. Rego extends Datalog to support structured document models such asJSON. Rego queries are assertions on data stored in OPA. These queries canbe used to define policies that enumerate instancesof data that violate the expected state of the system.” Rego policy language
- 5. The Rego playground - try it out! https://play.openpolicyagent.org/ https://play.openpolicyagent.org
- 6. Data Inordertomake informeddecisions,OPAneedsdata. Thereare manyway ofprovidingOPA withthis. • Input (along with the request),including JWTs • Push data into OPA • Bundleserver(pull) • http.send function
- 7. Policy management – “the centralized parts” OPA delegatesmanagementresponsibilitiesusingseveralmanagement APIs • The bundleAPI • The decision log API • Status and healthAPI
- 8. Demo OPA server and simple policy authoring
- 9. Use cases and integrations
- 11. Validating admission controller webhook
- 12. Mutating admission controller webhook
- 13. Integration with databases, and much more! https://www.openpolicyagent.org/docs/latest/ecosyst em
- 15. Running OPA as a sidecar
- 16. Demo OPA runningas sidecarinthreedeployments,simulatingann-tieredarchitecture,where thefirstcallcomesin totheAPItier,whichauthorizestherequest(datafromJWT) beforepassingit(includingtheJWT)forwardto theorchestrationtier,whichdoesthesame thing,beforepassingitforwardtotheservicetier. Each service/tier is responsible for authorizingthe request, given any unique requirements it may have.
- 17. Demo
- 18. Finally Thanks!
Editor's Notes
- #3: General purpose policy engine. Decouples (most commonly, authorization) policies from application logic. Provides a unified way of dealing with policies across the stack, independent to other technology choices made. Use cases ranging from kubernetes admission control, microservice authorization and data sources, to CI/CD pipeline policies. Vibrant Open Source Project with a commercial backer (Styra).
- #7: VS ”old school” model where data is retrieved from permissions store