Alex Krause
[email protected]
@alex0ptr
Cloud Compliance
with Open Policy Agent
Slide 2
Slide 2 text
The Problem
@alex0ptr
Slide 3
Slide 3 text
Policy
@alex0ptr
“Users should only access data
of their own teams/projects.
”
// TODO
Compliance
“Security First. Least Privilege,
where possible.
”
Governance
Slide 4
Slide 4 text
@alex0ptr
May this action be allowed?
Who or what can perform a certain action?
Are there violations?
Slide 5
Slide 5 text
Infrastructure
Machines Network DNS RDBMS
Storage
Application Platform
Container
Orchestration
Container
Images
CD-
Pipeline
Applications
User Management
Configuration
HTTP APIs + UIs
Code
Continuous
Integration
Code
Artifacts
Version
Control
Logs
Secret
Store
API
Gateways
Metrics
Backups
@alex0ptr
Life of the YAML
-Engineer
(1) Many components, which (2) use different concepts,
protocols, and configuration languages, with(3) strong coupling
to the concrete implementation.
The Problems ✔
@alex0ptr
Slide 8
Slide 8 text
Solution?
@alex0ptr
Slide 9
Slide 9 text
@alex0ptr
Open Policy Agent
Engine + Language
Slide 10
Slide 10 text
@alex0ptr
Open Policy Agent
‣ Policy Engine
‣ universal
‣ lightweight
‣ de-coupled
‣ easy to integrate
“Policy-based control for cloud native
environments”
Slide 11
Slide 11 text
@alex0ptr
OPA: Rego
‣ inheritance: datalog
‣ declarative, logic
‣ made for Policies
‣ and structured data
“Use Rego for defining policy that is easy
to read and write.”
Slide 12
Slide 12 text
@alex0ptr
Slide 13
Slide 13 text
@alex0ptr
Slide 14
Slide 14 text
The Dream:
✨ Central Policy Repository ✨
@alex0ptr
Slide 15
Slide 15 text
The Present
@alex0ptr
Slide 16
Slide 16 text
Demo
The Basics
@alex0ptr
Slide 17
Slide 17 text
@alex0ptr
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest()
.authenticated()
.accessDecisionManager(accessDecisionManager());
}
@Bean
public AccessDecisionManager accessDecisionManager() {
List> decisionVoters = Arrays
.asList(new OPAVoter("http://localhost:8181/v1/data/http/authz/allow"));
return new UnanimousBased(decisionVoters);
}
}
Slide 18
Slide 18 text
@alex0ptr
“Policy Controller for Kubernetes”
‣ K8s Admission Controller
‣ CRDs for Policies
‣ Audit
‣ Policy Library
Gatekeeper
Slide 19
Slide 19 text
Demo
Gatekeeper
@alex0ptr
Slide 20
Slide 20 text
@alex0ptr
“Write tests against structured
configuration data […]”
‣ CLI wrapper for OPA
‣ shift-left for Policies
‣ YAML/JSON, HCL(2), INI,
TOML, Dockerfile
‣ go-getter support
Conftest