SpringOne Platform 2019 Title: Policy Enforcement on Kubernetes with Open Policy Agent Speakers: Aleks Saul, Senior Platform Architect, Pivotal; Jaime Gonzalez Aguilar, Advisory Platform Architect, Pivotal Youtube: https://youtu.be/UN0su8fdGcs

1. Policy Enforcement on
Kubernetes with OPA
October 7–10, 2019
Austin Convention Center
Aleks Saul & Jaime Gonzalez Aguilar

2. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Who we are
Aleks Saul
Sr. Platform Architect, Pivotal Inc.
@alekssaul
2
Jaime Gonzalez Aguilar
Advisory Platform Architect, Pivotal Inc.
@jaimegag

3. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Agenda
● The Why, What and How of OPA
● OPA Use Cases
● Kubernetes Use Case
● Demo
● Q & A
3

4. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What is OPA?
4

5. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/ 5
POLICIES
GET /salary/{id}
#1 AuthZ
App Dev
#2 AuthZ
#3 AuthZ
Compliance
???
???

6. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Unify policy enforcement across the stack
Manage Policy - as - Code
Decouple policy from software
Why OPA?
6

7. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA: General-purpose Policy Engine
7
GET /salary/bob HTTP/1.1
Authorization: alice
true or false
{
“method”: “GET”,
“path”: [“salary”, “bob”],
“User”: “alice”
}

8. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA: General-purpose Policy Engine
8
“Service” refers to any of:
● API Gateway
● Kubernetes API Service
● Custom Service
● CI/CD pipeline script
● etc
Output can be any JSON valueInput can be any JSON value:

9. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
● Easy to read and write
● Declarative
● Handles complex data
Rego: OPA’s policy language
9
package kubernetes.admission
deny[msg] {
input.request.kind.kind == "Pod"
image :=
input.request.object.spec.containers[_].image
not startswith(image, "hooli.com/")
msg := sprintf("image fails to come from trusted
registry: %v", [image])
}

10. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/ 10

11. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
11
Kubernetes API request workflow
** Further information available in:
https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
Mutating
Admission
Controller
Mutating
Admission
Controller
Validating
Admission
Controller

12. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
12
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
$ kubectl apply -f service.yaml
apiVersion: v1
kind: Service
metadata:
name: coolapp
labels:
app: coolapp
spec:
ports:
- name: coolapp
port: 80
selector:
app: coolapp
type: LoadBalancer

13. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
13
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
$ kubectl apply -f service.yaml
Custom
Service
Admission
Controller
Service Type
Load Balancer
Not Allowed!!!
apiVersion: v1
kind: Service
metadata:
name: coolapp
labels:
app: coolapp
spec:
ports:
- name: coolapp
port: 80
selector:
app: coolapp
type: LoadBalancer

14. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
14
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
$ kubectl apply -f service.yaml
apiVersion: v1
kind: Service
metadata:
name: coolapp
labels:
app: coolapp
spec:
ports:
- name: coolapp
port: 80
selector:
app: coolapp
type: ClusterIP
Custom
Service
Admission
Controller
ClusterIP
sounds good
to me

15. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
15
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
$ kubectl apply -f ingress.yaml
Custom
Ingress
Admission
Controller
Ingress Route
Not Allowed!!!apiVersion:
networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: coolapp
spec:
rules:
- host: www.acmecorp.com
http:
paths:
- backend:
serviceName: coolapp
servicePort: 80
apiVersion:
networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: coolapp
spec:
rules:
- host: www.qa.acmecorp.net
http:
paths:
- backend:
serviceName: coolapp
servicePort: 80
Ingress Route
looks good to
me

16. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
OPA In Kubernetes - Why is it needed?
16
API Request API
HTTP
handler
Auth-n
Auth-z
Mutating
admission
Object
Schema
Validation
Validating
admission
Persisted
to etcd
$ kubectl apply -f policy_ingress.yaml
deny[msg] {
input.request.kind.kind =
"Ingress"
input.request.operation =
"CREATE"
host =
input.request.object.spec.rules[_].ho
st
not fqdn_matches_any(host,
valid_ingress_hosts)
msg = sprintf("invalid ingress
host %q", [host])
}
valid_ingress_hosts = {host |
whitelist =
namespaces[input.request.namespace].m
etadata.annotations["ingress-
whitelist"]
hosts = split(whitelist, ",")
host = hosts[_]
}
Custom
Ingress
Admission
Controller
package kubernetes.admission
import data.kubernetes.namespaces
deny[msg] {
input.request.kind.kind ==
"Service"
input.request.operation ==
"CREATE"
input.request.object.spec.type ==
"LoadBalancer"
msg = "Service Type LoadBalancer
is not allowed"
}
$ kubectl apply -f policy_service.yaml

17. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Kubernetes Use Cases
17
● ServiceType
○ Restrict Cloud Load Balancer
○ Restrict Cloud Load Balancer to internal only
● Registry Whitelist/blacklist
● Ingress
○ Validate domain
○ Validate TLS
● NetworkPolicy validation

18. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Demo!
� Show Harbor Registry and Image Repository
� Show OPA Admission Controller
� Show and deploy Policy
� Attempt to deploy Pod and show failure
� Change to fulfill Policy, deploy Pod and show success

19. Thank You!
Aleks Jaime
@alekssaul @jaimegag
@OpenPolicyAgent
https://www.openpolicyagent.org/
https://github.com/open-policy-agent
Open Policy Agent Summit - (KubeCon NA 2019)
San Diego, CA November 18, 2019
#springone@s1p