Open policy agent

1. Open Policy Agent
Introduction

2. Labyrinth Labs is a boutique expert shop
focusing on DevOps, Public Cloud and
Kubernetes ecosystem.
Our mission is to help companies evolve
their applications into the containerized
and serverless future.
We are a privately owned company mainly
driven by technical excellence
and our passion in modern application
technologies.
About us

3. Agenda
● Introduction
● Policy decision model
● Interactions with OPA
● Rego basics
● Performance
● Ecosystem
● Gatekeeper example

4. Open Policy Agent
Introduction

5. OPA - Overview
● General purpose policy engine
● Decouples policy from application logic
● Offload policy decision-making from your software
to enforce policies
● Toolset and framework for policy across the cloud
native stack
● Declarative Policy as a Code with REGO

6. OPA - Community
● CNCF graduated
● 30+ integrations
● Vibrant community
● Good tooling and ecosystems
● Users

7. Policy Decision Model

8. OPA - Operational Model
● Service query OPA with
structured data
● Based on policy and data OPA
evaluates query
● Returns decision as response
with structured data to the
service

9. OPA - Data Model
● Data classification
○ Base documents
○ Virtual documents

10. OPA - External Data
● Data size
● Update frequency
● Consistency model
● Loading options:
○ Sync push
○ Sync push overload
○ Periodic pull - Bundle API
○ Async push data
○ Pull data during evaluation

11. OPA - External Data
● Sync push - base document
○ updates
○ size
● Usage:
○ User attributes

12. OPA - External Data
● Sync push overload - base
document
○ updates
○ size
● Usage:
○ Local & Dynamic data

13. OPA - External Data
● Bundle API
○ updates
○ size
○ consistency
○ persistency
● Usage:
○ Static & Medium-sized
data

14. OPA - External Data
● Push data
○ updates
○ size
● Usage:
○ Dynamic & Medium-sized
data

15. OPA - External Data
● Pull data during evaluation
○ updates
○ size
○ performance
● Usage:
○ Dynamic & Large-sized
data

16. OPA - APIs
● Policy
● Data
● Query
● Compile
● Auth
● Trace
● Metrics
● Config

17. OPA - Policy API

18. OPA - Data API

19. OPA - Query API
Policy Request Resposne
POST / == POST /system/main

20. Interactions

21. OPA - Interactions
● Command line (+interactive mode)
● Library
● Server (HTTP)
○ Sidecar
○ Host-level daemon
○ Distributed service

22. REGO Language

23. OPA - REGO Language
● Inspired by Datalog
● Relatively easy for reading / writing
● Declarative

24. OPA - REGO Example
● Pet Store example with RBAC policy

25. OPA - Rich set of primitives
● Arrays / Objects / Sets
○ lookups, iterations
○ concat, …, unions
● Rules, functions
○ conditionals, incremental, else
● Comparisons, Math
● String manipulations, regexp, …
● Many more

26. Performance

27. OPA - Performance
● Evaluation budget order of 1 ms
● Linear fragment
● Use objects over arrays

28. OPA - Performance partial evaluation

29. OPA - Performance indexing statements

30. OPA - Performance comprehension Indexing

31. OPA - Performance envoy example

32. Ecosystem

33. OPA - Integrations

34. OPA - Roadmap

35. OPA - Tooling
● OPA cli
○ eval
○ bench
○ fmt
○ check
● VS code, IntelliJ plugins
● conftest
● terrascan
● OPAL
● rego playground

36. OPA - inspiration
● terrascan rego
● gatekeeper library
● scalr sample policies
● OPA PoC & contributions

37. Examples
-
Kubernetes Gatekeeper

38. OPA - Gatekeeper

39. OPA - Gatekeeper

40. OPA - Gatekeeper policy enforcement

41. OPA - Gatekeeper audit

42. OPA - Gatekeeper Library General
● K8sAllowedRepos
● K8sBlockNodePort
● K8sContainerLimits
● K8sContainerRatios
● K8sDisallowedTags
● K8sHttpsOnly
● K8sImageDigests
● K8sRequiredLabels
● K8sRequiredProbes
● K8sUniqueIngressHost
● K8sUniqueIngressHost
● K8sExternalIPs

43. OPA - Gatekeeper PSP replacement

44. Thank you
Martin Dojcak
CTO & Co-founder
Contact:
martin.dojcak@lablabs.io