Cloud Native Night, Juli 2020, talk by Alex Krause (@alex0ptr, Software Engineer at QAware) == Please download slides if blurred! == Abstract: Microservices distribute the complexity of applications into smaller processes and infrastructure. In conclusion policies for encyrption, cost labelling or access control become decentralized too. The already complex components of a cloud-native application, such as container orchestration, IaaS components and CI/CD pipelines, complicate the technically uniform definition of these guidelines further. OPA (Open Policy Agent) is a CNCF tool to define and check policies. What makes OPA special is the easy integration into cloud-native environments in combination with rego, a universal logical programming language which allows defining policies across technology boundaries. This technical presentation is an introduction into OPA and demonstrates typical use-cases. About Alex: Alex Krause is Senior Software Engineer at QAware and passionate about DevOps, Cloud-Native Microservices and Reactive Programming.

1. Alex Krause
alex.krause@qaware.de
@alex0ptr
Cloud Compliance
with Open Policy Agent

2. The Problem
@alex0ptr

3. Policy
@alex0ptr
“Users should only access data
of their own teams/projects.”
// TODOCompliance
“Security First. Least Privilege,
where possible.”
Governance

4. @alex0ptr
May this action be allowed?
Who or what can perform a certain action?
Are there violations?

5. Infrastructure
Machines Network DNS RDBMSStorage
Application Platform
Container
Orchestration
Container
Images
CD-
Pipeline
Applications
User Management
Configuration
HTTP APIs + UIs
Code
Continuous
Integration
Code
Artifacts
Version
Control
Logs
Secret
Store
API
Gateways
Metrics
Backups
@alex0ptr
💫 Life of the YAML-Engineer

6. @alex0ptr
@PreAuthorize("#username == authentication.principal.username")
public String getMyRoles(String username) {
//...
}
👻

7. (1) Many components, which (2) use different concepts,
protocols, and configuration languages, with(3) strong coupling
to the concrete implementation.
The Problems ✔
@alex0ptr

8. Solution? 🔨
@alex0ptr

9. @alex0ptr
Open Policy Agent
Engine + Language

10. @alex0ptr
Open Policy Agent
‣ Policy Engine
‣ universal
‣ lightweight
‣ de-coupled
‣ easy to integrate“Policy-based control for cloud native
environments”

11. @alex0ptr
OPA: Rego
‣ inheritance: datalog
‣ declarative, logic
‣ made for Policies
‣ and structured data
“Use Rego for defining policy that is easy
to read and write.”

12. @alex0ptr

13. @alex0ptr

14. The Dream:
✨ Central Policy Repository ✨
@alex0ptr

15. The Present
@alex0ptr

16. 🎊 Demo 🎉
The Basics
@alex0ptr

17. @alex0ptr
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest()
.authenticated()
.accessDecisionManager(accessDecisionManager());
}
@Bean
public AccessDecisionManager accessDecisionManager() {
List<AccessDecisionVoter<? extends Object>> decisionVoters = Arrays
.asList(new OPAVoter("http://localhost:8181/v1/data/http/authz/allow"));
return new UnanimousBased(decisionVoters);
}
}

18. @alex0ptr
“Policy Controller for Kubernetes”
‣ K8s Admission Controller
‣ CRDs for Policies
‣ Audit
‣ Policy Library
Gatekeeper
🎉

19. 🎊 Demo 🎉
Gatekeeper
@alex0ptr

20. @alex0ptr
“Write tests against structured
configuration data […]”
‣ CLI wrapper for OPA
‣ shift-left for Policies
‣ YAML/JSON, HCL(2), INI,
TOML, Dockerfile
‣ go-getter support
Conftest
🎉

21. 🎊 Demo 🎉
Conftest
@alex0ptr

22. Conclusion
@alex0ptr

23. 😄 😕
@alex0ptr
Gatekeeper Rego
Conftest Tooling
Integration Integrations
Complexity

24. xing.com/companies/qawaregmbh
linkedin.com/company/qaware-gmbh slideshare.net/qaware
twitter.com/qaware github.com/qaware
youtube.com/qawaregmbh
Alex Krause
alex.krause@qaware.de
@alex0ptr

25. QAware21.09.2018 25

26. QAware GmbH Mainz
Rheinstraße 4 D
55116 Mainz
Tel.: +49 (0) 6131 215 69 – 0
Fax: +49 (0) 6131 215 69 – 68 xing.com/companies/qawaregmbh
linkedin.com/company/qaware-gmbh slideshare.net/qaware
twitter.com/qaware github.com/qaware
youtube.com/qawaregmbh

27. QAware GmbH München
Aschauer Straße 32
81549 München
Tel.: +49 (0) 89 23 23 15 – 0
Fax: +49 (0) 89 23 23 15 – 129 xing.com/companies/qawaregmbh
linkedin.com/company/qaware-gmbh slideshare.net/qaware
twitter.com/qaware github.com/qaware
youtube.com/qawaregmbh