OPA for policy OPA for policy enforcement enforcement Sibi Prabakaran April 29, 2020

Agenda Agenda Overview of OPA Rego Usecases/Integra ons Example integra on of OPA + Python web service

OPA OPA Project started in a company named Styra at 2016 Currently an incubator project at Linux founda on (CNCF) Goal: Unify policy enforcement

Overview Overview

Rego Rego Language for wri ng policy Expresssions, Variables, Rules Itera on Tooling

Expressions Expressions > input.servers[0].protocols[0] "https" > input.servers[0].protocols[0] undefined decision input.servers[0].id == "app" input.servers[0].protocols[0] == "https"

Rego Variables Rego Variables hello := "world"

Iteration Iteration networks = [{ "id": "net1", "public": false}, { "id": "net2", "public": false}] > networks[x] +---+------------------------------+ | x | networks[x] | +---+------------------------------+ | 0 | {"id":"net1","public":false} | | 1 | {"id":"net2","public":false} | +---+------------------------------+

Rules Rules any_public_networks = true { # is true if... net := networks[_] # some network exists and.. net.public # it is public. }

API Integration API Integration Python code Rego code

Experience Experience Policies Error messages aren’t nice Community Tooling

OPA OPA Integrations Integrations

Comparision Comparision with Sentinel with Sentinel Open Source Applicable more generally Language differences

Other Stu Other Stu WASM Support Editor integra ons h ps:/ /play.openpolicyagent.org/

Haskell Haskell - Fugue Rego Toolkit h ps:/ /github.com/fugue/fregot

Questions Questions