Upgrade to Pro — share decks privately, control downloads, hide ads and more …

入門Open Policy Agent: Policy as Codeを目指して / introduction-to-open-policy-agent

Kurochan
September 16, 2021

入門Open Policy Agent: Policy as Codeを目指して / introduction-to-open-policy-agent

サイバーエージェントの社内エンジニアカンファレンス CA BASE CAMP 2021で発表した資料です

Kurochan

September 16, 2021
Tweet

More Decks by Kurochan

Other Decks in Technology

Transcript

  1. גࣜձࣾαΠόʔΤʔδΣϯτ AIࣄۀຊ෦
    ೖ໳Open Policy Agent
    Policy as CodeΛ໨ࢦͯ͠
    ࠇ࡚ ༏ଠ

    View Slide

  2. ࠇ࡚ ༏ଠ
    2015೥౓ ৽ଔೖࣾ
    AIࣄۀຊ෦ DXຊ෦ ΞϓϦӡ༻ηϯλʔ
    @kurochan
    @kuro_m88
    ج൫ٕज़੹೚ऀ
    🆕 αΠόʔΤʔδΣϯτ CTO౷ׅࣨ
    #times_kurochan

    View Slide

  3. ࠓճ͓࿩͢Δ಺༰
    • Open Policy Agentͱ͍͏ιϑτ΢ΣΞʹ͍ͭͯͷ঺հ
    • Open Policy Agent͸ೝՄͷจ຺Ͱ঺հ͞ΕΔ͜ͱ͕ଟ͍͕ɺ
    ΋͏গ͠Ҿ͍ͯʮϙϦγʔʯͱ͍͏ࢹ఺͔Β঺հ
    • ΞϓϦӡ༻ηϯλʔͰಋೖ͢Δ༧ఆ͕͋ΔͷͰ
    ૝ఆ͍ͯ͠ΔϢʔεέʔεͷ঺հ

    View Slide

  4. 1.Open Policy Agentͱ͸
    2.Policy as Code
    3.Open Policy Agentͷ࢖͍ํ
    4.Open Policy Agentͷ࢖͍ॴ
    5.ΞϓϦӡ༻ηϯλʔͰͷ
    Open Policy Agentͷಋೖ༧ఆ

    View Slide

  5. Open Policy Agentͱ͸

    View Slide

  6. Open Policy Agentͱ͸
    • ܰྔͳ൚༻ͷʮϙϦγʔΤϯδϯʯ
    • ಠཱͯ͠ಈ͔͢͜ͱ΋Ͱ͖Δ͠ɺαʔϏεʹϥΠϒϥϦͱͯ͠౷߹͢Δ͜ͱ΋Մೳ
    • WebAssembly΋αϙʔτͯͨ͠Γ
    • OPAͱུ͞ΕΔ͜ͱ͕ଟ͍
    • ΫΤϦʹରͯ͠ϙϦγʔΛద༻ɺ݁ՌΛੜ੒͢Δ
    • ϙϦγʔ͸Regoͱ͍͏ݴޠͰੜ੒͢Δ

    View Slide

  7. "Policy"ͱ͸
    • ϧʔϧͷू߹
    • ೖྗΛ৚݅Ͱൺֱͨ͠Γ
    • rate limitͷΑ͏ʹಈతʹมΘΔΑ͏ͳ΋ͷͩͬͨΓ
    • ͦΕΒΛ૊Έ߹ΘͤͨΓ
    • ࠷ऴతʹԿ͔͠ΒͷҙࢥܾఆΛ͢Δ

    View Slide

  8. ϙϦγʔΤϯδϯΛ෼཭͢Δͱ͍͏͜ͱ
    • ϙϦγʔͷ࣮૷͸೉͍͠
    • ਖ਼࣮͘͠૷Ͱ͖·͔͢…ʁ
    • ෳࡶͳϙϦγʔ͸ϙϦγʔࣗମͷڍಈΛςετ͍ͨ͠
    • ࠓճ͸ʮϙϦγʔΤϯδϯʯͱ͍͏෦඼͕༷ʑͳϢʔεέʔεʹద༻Մ
    ೳͰ͋Δ͜ͱΛ͓࿩͠·͢

    View Slide

  9. Policy as Code

    View Slide

  10. Policy as Code
    • XXX as Code
    • Infrastructure as CodeͳͲ
    • ϙϦγʔ͸ͦΕࣗମ͕γεςϜͷٕज़తͳ੍໿΍ηΩϡϦςΟͳͲɺ
    ॏཁͳ஌ࣝΛ಺แ͍ͯ͠Δ
    • ΞϓϦέʔγϣϯίʔυதʹຒΊࠐ·ΕΔΑΓϙϦγʔͱͯ͠
    ಠཱͯ͠ఆٛ͢Δ͜ͱͰ҉໧஌Խ͢Δ͜ͱ΋๷͙͜ͱ͕Ͱ͖Δ

    View Slide

  11. Rego
    • ϙϦγʔΛهड़͢ΔͨΊͷݴޠ
    • ߏ଄Խ͞Ε͍ͯͯ֊૚తͳσʔλߏ଄Λ࣋ͯΔ
    • JSONͷΑ͏ͳߏ଄΋ѻ͑Δ
    • ϙϦγʔͷద༻݁Ռ΋ಉ༷ʹॊೈͳσʔλߏ଄ͰදݱͰ͖Δ
    • ೖग़ྗͷσʔλߏ଄͕͔ͳΓࣗ༝
    • ৚݅ࣜ΍ؔ਺΋ॆ࣮

    View Slide

  12. Regoͷจ๏ྫ
    • งғؾ͚ͩ঺հ͠·͢
    • ਖ਼͍͠จ๏͸ެࣜυΩϡϝϯτΛࢀর͍ͯͩ͘͠͞
    https://www.openpolicyagent.org/docs/latest/policy-language/

    View Slide

  13. Regoͷจ๏ྫ: ม਺

    View Slide

  14. Regoͷจ๏ྫ: Object

    View Slide

  15. Regoͷจ๏ྫ: Rule

    View Slide

  16. Regoͷจ๏ྫ: Rule

    View Slide

  17. Regoͷจ๏ྫ: ৚݅
    • ࢛ଇԋࢉɺ౳߸ɺෆ౳߸ɺϏοτԋࢉͳͲ͸΋ͪΖΜఆٛ͞Ε͍ͯΔ͕
    ͜ΕΒ͸͢΂ͯϏϧτΠϯؔ਺ͱͯ͠ѻΘΕΔ

    View Slide

  18. Regoͷจ๏ྫ: ϏϧτΠϯؔ਺
    • Ϗοτԋࢉɺू߹ԋࢉɺਖ਼نදݱɺจࣈྻૢ࡞
    • Base64ɺURLɺJSON/YAMLɺUUID
    • ࣌ࠁ
    • άϥϑ
    • ωοτϫʔΫ
    • τʔΫϯ(JWTͳͲ)
    • ଞʹ΋ศརͳؔ਺͕࠷ॳ͔Βͨ͘͞Μ༻ҙ͞Ε͍ͯΔ

    View Slide

  19. ؆୯ͳྫ
    • HTTPϦΫΤετͷೝՄ
    • user "alice" ͸ /hello ʹରͯ͠GETϦΫΤετ͕Ͱ͖Δ

    View Slide

  20. The Rego Playground
    • ϒϥ΢β্ͰRegoΛॻ͍ͯࢼͤͯศར
    https://play.openpolicyagent.org/

    View Slide

  21. Testable
    • ςετ͕ॻ͚Δʂ

    View Slide

  22. Testable
    • ςετ͕ॻ͚Δʂ

    View Slide

  23. Open Policy Agentͷ࢖͍ํ

    View Slide

  24. REST API

    View Slide

  25. ೝՄػೳΛඋ͑ͨAPI
    • ೝূͱೝՄ
    • ೝূ(Authenticate)
    • ʮ୭ͳͷ͔ʯΛࣝผ͢Δ
    • ೝՄ(Authorize)
    • ʮԿ͕Ͱ͖Δͷ͔(Ͱ͖ͳ͍ͷ͔)ʯΛ൑அ͢Δ

    View Slide

  26. RBACΛ࣮૷ͯ͠ΈΔ

    View Slide

  27. External Data
    • ͜͜·Ͱͷྫͩͱuser_roles΍role_permissions૬౰͸ݻఆ
    • ࣮༻్Ͱ͸ಈతʹมԽͤͨ͞Γ૿ݮ͍ͤͨ͞
    • ϙϦγʔΛධՁ͢Δʹ͋ͨͬͯඞཁͳ৘ใΛ֎෦͔Βऔಘ͢Δ࢓૊Έ

    View Slide

  28. ϦΫΤετʹຒΊࠐΉ
    • ϦΫΤετΛૹ৴͢Δଆ͕෇Ճ৘ใΛૹ৴͢Δ
    • ΋ͪΖΜૹΒΕͯ͘Δ஋͕৴༻Ͱ͖ͳ͍ͱμϝ
    • ৴༻Ͱ͖Δͱ͍͏લఏ͔ɺ
    JWTͳͲͰॺ໊͞Εͨ஋Λݕূͯ͠࢖͏͔
    https://www.openpolicyagent.org/docs/latest/external-data/

    View Slide

  29. σʔλΛ౉͢(push)
    • ֎෦͔Βߋ৽͕͋Δ౓ʹpush͢Δ
    • ಉظ࿙Εͱ͔ϥά͕ى͖Δͱ͜Θ͍͔΋
    • ͋·Γେ͖ͳσʔλ͸஗Εͳ͍
    https://www.openpolicyagent.org/docs/latest/external-data/

    View Slide

  30. σʔλΛ΋Β͏(pull)
    • OPA͕ಈతʹ֎෦ͷAPIΛݺͼग़ͤΔ(B)
    • OPAͷϨεϙϯελΠϜ͸૿Ճ͢Δ
    • ॊೈʹ࿈ܞ͠΍ͦ͢͏
    https://www.openpolicyagent.org/docs/latest/external-data/

    View Slide

  31. Testing

    View Slide

  32. ςετ
    • ϙϦγʔͱಉ͡σΟϨΫτϦʹςετϑΝΠϧΛஔ͘
    • "test_"Ͱ࢝·Δϧʔϧ͕ධՁ͞ΕɺͦΕ͕ςετʹͳΔ
    • opa testίϚϯυͰςετ͕࣮ߦͰ͖Δ
    • ΧόϨοδܭଌ΋Մೳ

    View Slide

  33. ஋ͷϞοΫ
    • withΩʔϫʔυͰ஋Λஔ͖׵͑ΒΕΔ

    View Slide

  34. Open Policy Agentͷ࢖͍Ͳ͜Ζ

    View Slide

  35. Open Policy Agentͷ࢖͍Ͳ͜Ζ
    • Kubernetesͷݖݶ؅ཧͷจ຺Ͱ঺հ͞ΕΔ͜ͱ͕ଟ͍ҹ৅
    • ͦΕҎ֎ͷ༻్Λத৺ʹ঺հ͠·͢

    View Slide

  36. Envoy

    View Slide

  37. Envoyͱ͸
    https://speakerdeck.com/kurochan/ru-men-envoy

    View Slide

  38. Envoyͱ͸
    • OSSͷL4/L7ϓϩΩγ
    • ʮϞμϯͳαʔϏεࢦ޲ΞʔΩςΫνϟʯ޲͚
    • ʮϢχόʔαϧσʔλϓϨʔϯʯΛ໨ࢦͯ͠։ൃ͞Ε͍ͯΔ
    • ύϑΥʔϚϯεʹ༏Εɺ֦ுੑ͕ߴ͘ɺAPIܦ༝ͰίϯτϩʔϧՄೳ
    https://www.envoyproxy.io/docs/envoy/latest/intro/what_is_envoy

    View Slide

  39. Envoy࿈ܞ
    • EnvoyͱOPAΛ࿈ܞͤͯ͞ೝՄػೳ෇͖ͷήʔτ΢ΣΠΛߏ੒Մೳ
    https://www.openpolicyagent.org/docs/latest/envoy-introduction/

    View Slide

  40. Envoy࿈ܞ
    • EnvoyͱOPAΛ࿈ܞͤͯ͞ೝՄػೳ෇͖ͷήʔτ΢ΣΠΛߏ੒Մೳ
    • ೝՄ͞ΕͨτϥϑΟοΫ͔͠௨ա͠ͳ͍
    • ޙஈͷΞϓϦέʔγϣϯαʔό౳ͷ࣮૷ָ͕ʹͳΔ

    View Slide

  41. Terraform

    View Slide

  42. TerraformʹϙϦγʔΛద༻͢Δʁ
    • terraform.analysisͱ͍͏ύοέʔδ͕༻ҙ͞Ε͍ͯΔ
    • terraform planͷ݁Ռ͕ҙਤ͍ͯ͠Δ͔Ͳ͏͔ͷνΣοΫ͕Ͱ͖Δ
    • CIͳͲʹ૊ΈࠐΉͱࣄނ๷ࢭͷνΣοΫʹͳΔ
    • ྫ
    • ෆ༻ҙʹIAMͷઃఆมߋ͕͞Ε͍ͯͳ͍͔ʁ
    • ࣮ߦͨ͠ਓ͕؅ཧऀͰ͋Ε͹OKͳͲͷίϯςΩετ΋࣋ͨͤΒΕͦ͏
    • Ұఆͷᮢ஋Ҏ্ͷมߋ͕Ұ౓ʹͳ͞Ε͍ͯͳ͍͔ʁ
    • ޡͬͯ؀ڥΛഁյ͞Εͳ͍Α͏ʹͰ͖ͦ͏

    View Slide

  43. Terraform࿈ܞͷྫ
    • terraform planͷ݁Ռʹରͯ͠ϙϦγʔΛద༻͢Δ

    View Slide

  44. ϩά؂ࢹ

    View Slide

  45. ϩάʹϙϦγʔΛద༻͢ΔͱͲ͏ͳΔͷ͔
    • ϩά؂ࢹͰΑ͘΍Δ͜ͱ
    • ΤϥʔΧ΢ϯτ
    • ҟৗ஋ͷݕग़
    • ෳࡶͳ৚݅Ͱͷϩά؂ࢹ
    • ಛఆͷIPΞυϨε͔Βͷෆਖ਼ͳΞΫηε
    • S3όέοτͷՄࢹൣғͷઃఆมߋ
    • ͳͲ
    • ͦΕɺOPAͰݕग़Ͱ͖ΔͷͰ͸…ʁ
    • Կ͔ͷҙࢥܾఆΛ͢ΔҎ֎ʹ΋ɺಛఆ৚݅ͷΞΫςΟϏςΟͷݕग़ʹ΋͔ͭ͑Δʂ

    View Slide

  46. ΧελϚΠζ

    View Slide

  47. ͜͜·ͰͰ෼͔ͬͨ͜ͱ
    • Open Policy Agent͸೚ҙͷೖྗʹରͯ͠ϙϦγʔΛద༻ͨ݁͠ՌΛ
    ฦ͢ύʔπͱ͔ͯ͠ͳΓ൚༻ੑ͕ߴ͍
    • Open Policy AgentΛαʔϏεʹ૊ΈࠐΜͰ࢖͏ʹ͸
    Ͳ͏͢Ε͹Α͍ͷ͔

    View Slide

  48. REST API
    • input JSONͰPOST͢ΔͱɺϨεϙϯε͕JSONͰฦͬͯ͘Δ

    View Slide

  49. Go API
    • GolangͷϥΠϒϥϦͱͯ͠ݺͼग़͢͜ͱ͕Մೳ

    View Slide

  50. ΞϓϦӡ༻ηϯλʔͰͷ
    Open Policy AgentͷಋೖΞΠσΞ

    View Slide

  51. ΞϓϦӡ༻ηϯλʔͱ͸
    • 140ஹԁͷڊେࢢ৔ɺখചۀքͷ࠶ൃ໌ʹ௅Ή։ൃϓϩδΣΫτ
    https://speakerdeck.com/kurochan/retail-dx-project

    View Slide

  52. ΞϓϦӡ༻ηϯλʔͰ։ൃ͍ͯ͠ΔγεςϜͨͪ
    • ڠಇൢଅ޲͚γεςϜ
    • ձһΞϓϦ
    • ECαΠτ
    • σʔλج൫
    • ͜ΕΒͷ؅ཧը໘
    • ༷ʑͳϙϦγʔͰΞΫηε੍ޚΛ͍ͨ͠

    View Slide

  53. ΞϓϦӡ༻ηϯλʔͱ͸
    • খചۀքͷDXΛਪਐ͢ΔϓϩμΫτΛ։ൃ͢Δ෦ॺ
    • ͍ΖΜͳγεςϜΛ։ൃ͢Δ
    • ͍ΖΜͳγεςϜ = ͍ΖΜͳAPI
    • ೝূೝՄ͕༷ʑͳγʔϯͰൃੜ͢Δ
    • ͦΕͧΕϏδωεཁ݅΋ඍົʹҟͳΔͷͰ͖ͪΜͱϧʔϧͱͯ͠؅ཧ͍ͨ͠
    • Policy as Codeͷػӡ…ʂ
    • ೝূ => IdP, ೝՄ => ???

    View Slide

  54. Open Policy AgentΛ༻͍ͨRBAC
    ڋ൱
    ڐՄ
    ڐՄ
    ϦιʔεA
    ϦιʔεB
    A͞Μ
    B͞Μ
    σʔλϕʔεͷ஋ͳͲʹԠͯ͡ಈతʹΞΫηεΛڐՄ͢Δ͔൑அ͍ͨ͠

    View Slide

  55. Open Policy AgentΛ༻͍ͨRBAC
    https://www.openpolicyagent.org/docs/latest/external-data/
    • ϢʔβA͕ϦιʔεB΁ͷΞΫηεΛͯ͠Α͍͔͕ಈతʹมΘΔέʔε
    • External DataΛ༻͍ͯղܾ

    View Slide

  56. ൚༻తͳΞʔΩςΫνϟ
    • ೝূೝՄͷ͘͠ΈΛςϯϓϨʔτԽ͍ͨ͠
    • Envoy + OPA + Backend API
    • Envoy: ೝՄήʔτ΢ΣΠ
    • OPA: ೝՄϙϦγʔΤϯδϯ
    • Backend API: ϏδωεϩδοΫ

    View Slide

  57. ൚༻తͳΞʔΩςΫνϟ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ

    View Slide

  58. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ڐՄ͞ΕΔύλʔϯ

    View Slide

  59. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ڐՄ͞ΕΔύλʔϯ

    View Slide

  60. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ڐՄ
    ೝՄ৘ใ
    ෇Ճ৘ใ
    ڐՄ͞ΕΔύλʔϯ

    View Slide

  61. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ϦΫΤετ
    ڐՄ
    ೝՄ৘ใ
    ෇Ճ৘ใ
    ڐՄ͞ΕΔύλʔϯ

    View Slide

  62. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ϦΫΤετ
    ڐՄ
    ೝՄ৘ใ
    ෇Ճ৘ใ
    ڐՄ͞ΕΔύλʔϯ

    View Slide

  63. ϦΫΤετ ϨεϙϯεͷྲྀΕ
    ϦΫΤετ
    ΫϥΠΞϯτ
    ೝՄ৘ใ
    όοΫΤϯυ
    ೝՄ৘ใ
    ෇Ճ৘ใ
    ڋ൱
    ڋ൱͞ΕΔύλʔϯ

    View Slide

  64. ·ͱΊ

    View Slide

  65. ·ͱΊ
    • Open Policy Agentͱ͍͏OSSʹ͍ͭͯ঺հ͠·ͨ͠
    • ϙϦγʔΤϯδϯͷ൚༻ੑʹ͍ͭͯ঺հ͠·ͨ͠
    • ΞϓϦӡ༻ηϯλʔͰͷಋೖΞΠσΞʹ͍͓ͭͯ࿩͠·ͨ͠
    • ࣮ࡍʹಋೖࣄྫ͕Ͱ͖ͨΒͲ͔͜Ͱൃද͍ͨ͠ͱࢥ͍·͢

    View Slide

  66. ͝ࢹௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ

    View Slide