Slide 1

Slide 1 text

©2021 VMware, Inc. Open Policy Agent (OPA) ⼊⾨ Motonori Shindo / motonori_shindo VMware DevOps Meetup #7 2021/01/20

Slide 2

Slide 2 text

2 ©2021 VMware, Inc. 1980年代の思い出

Slide 3

Slide 3 text

3 ©2021 VMware, Inc. What is Policy ? 何かしらによって課される制約に対して、どうある べきかを規定するもの • 法律、条例 • ビジネスルール • アプリケーション要求 • 地域的制約 • セキュリティ的要件 • … Photo by Scott Graham on Unsplash

Slide 4

Slide 4 text

4 ©2021 VMware, Inc. 多くのシステムには個別にポリシーが存在している Policy Policy Policy Policy Policy Policy Policy Policy

Slide 5

Slide 5 text

5 ©2021 VMware, Inc. Open Policy Agent (OPA) とは Domain Agnositc な Policy Engine OPA は Policy Decision だけを⾏い、Policy Enforcement には関与しない Rego という Datalog Inspired な宣⾔的 Policy ⾔ 語を持つ オープンソース 利⽤⽅法 Library (Go)、REST API、Wasm Source: https://www.openpolicyagent.org/docs/latest/

Slide 6

Slide 6 text

6 ©2021 VMware, Inc. Rego Primer by example Network, Server, App Toplogies { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } JSON web app db p1 p2 p3 p4 Net1 (public) Net2 (private) https ssh tomcat mysql Internet

Slide 7

Slide 7 text

7 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output

Slide 8

Slide 8 text

8 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output Complete Rule: = { } が true であれば = になる。 ”= true” は省略可能。

Slide 9

Slide 9 text

9 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output “input” は予約されたグローバル変数。

Slide 10

Slide 10 text

10 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output [ ] は配列を表す。‘_’ は無名変数。後に参 照する必要がなければ無名変数を使うこと ができる。

Slide 11

Slide 11 text

11 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output 中の複数⾏の は、Logical AND として解釈される。” ; ” と書いても同様。

Slide 12

Slide 12 text

12 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output ”:=” は assginment(代⼊) operator。Rego の変数 は immutable なので、同じ変数に⼆度 ”:=” で代⼊す ることはできない。

Slide 13

Slide 13 text

13 ©2021 VMware, Inc. Rego Primer by example (1) Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages package example.rules any_public_networks = true { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "any_public_networks": true } Policy Input Output Package は Rego のルールに名前空間 を作り出す。Data API で呼び出される 場合も、この名前空間が使われる。

Slide 14

Slide 14 text

14 ©2021 VMware, Inc. Rego Primer by example (2) Partial Rules package example.rules public_network[net.id] { net := input.networks[_] net.public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "public_network": [ "net1" ] } Policy Input Output が [ ] を持っている場合は、Partial Rule と呼ばれ、複数の値をセットするのに 使われる。

Slide 15

Slide 15 text

15 ©2021 VMware, Inc. Rego Primer by example (3) Logical OR package example.rules shell_accessible[server.id] { server := input.servers[_] server.proto[_] == "telnet" } shell_accessible[server.id] { server := input.servers[_] server.proto[_] == "ssh" } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "shell_accessible": [ "web" ] } Policy Input Output 同じ を持つルールが複数ある場合 は、それらは Logical OR と解釈される。

Slide 16

Slide 16 text

16 ©2021 VMware, Inc. Rego Primer by example (4) Iterations package example.rules public_ports[id] { some i, j id := input.ports[i].id input.ports[i].network == input.networks[j].id input.networks[j].public } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "public_ports": [ "p1" ] } Policy Input Output Rego では に “some” で宣⾔ した変数を埋め込むことで暗黙的にループ が形成される

Slide 17

Slide 17 text

18 ©2021 VMware, Inc. クイズ Public な network に接続されている port を持っている server のリストを取得 package example.rules public_servers[server] { some i, j, k input.servers[i].ports[_] == input.ports[j].id input.networks[k].id == input.ports[j].network input.networks[k].public server := input.servers[i].id } { "servers": [ { "id": "web", "proto": ["https", "ssh"], "ports": ["p1", "p2"]}, { "id": "app", "proto": ["tomcat"], "ports": ["p3"]}, { "id": "db", "proto": ["mysql"], "ports": ["p4"]} ], "networks": [ {"id": "net1", "public": true}, {"id": "net2", "public": false} ], "ports": [ {"id": "p1", "network": "net1"}, {"id": "p2", "network": "net2"}, {"id": "p3", "network": "net2"}, {"id": "p4", "network": "net2"} ] } { "public_servers": [ "web" ] } Policy Input Output ??? 回答は後⽇ Tweet します。

Slide 18

Slide 18 text

19 ©2021 VMware, Inc. Built-in Functions https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions Comparisons • ==, !=, <, <=, >, >= Numbers • +, -, *, /, %, round(), abs(), etc. Aggregates • count(), sum(), max(), min(), product(), sort(), etc. Arrays • concat(), slice() Set • get(), remove(), union(), filter(), etc. Strings • concat(), contains(), startwith(), endswith(), etc. Regex / Glob • match(), is_valid(), split(), find_n(), etc. Glob • match(), quote_meta() Bitwise • or(), and(), negate(), xor(), lsh(), rsh() Conversions • to_number() Types • is_number(), is_string(), is_boolean(), etc. Encoding • encode(), decode(), marshal(), unmarshal(), etc.

Slide 19

Slide 19 text

20 ©2021 VMware, Inc. Built-in Functions (cont’d) https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions Token Signing • encode_sign_raw(), encode_sign() Token Verification • verify_rs256(), verify_rs384(), etc. Time • date(), clock(), weekday(), add_date(), etc. Cryptography • md5(), sha1(), sha256(), parse_certficates(), etc. Graphs • walk(), reachable() HTTP • send() Net • cidr_contain(), cidr_intersects(), etc. UUID • rfc4122() Semantic Versions • is_valid(), compare() Rego • parse_module() OPA • runtime() Debug • trace()

Slide 20

Slide 20 text

21 ©2021 VMware, Inc. Rego Playground https://play.openpolicyagent.org/

Slide 21

Slide 21 text

22 ©2021 VMware, Inc. OPA Ecosystem

Slide 22

Slide 22 text

23 ©2021 VMware, Inc. Kubernetes Integration - Gatekeeper Kubernetes API Server と OPA の 間のブリッジとして 動作 API Server が Gatekeeper の Webhook をトリ ガー 課したい制約を Rego で記述 Source: https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/

Slide 23

Slide 23 text

24 ©2021 VMware, Inc. Policy Template and Policy Instance CRD apiVersion: templates.gatekeeper.sh/v1beta1 kind: ConstraintTemplate metadata: name: k8srequiredlabels spec: crd: spec: names: kind: K8sRequiredLabels validation: # Schema for the `parameters` field openAPIV3Schema: properties: labels: type: array items: string targets: - target: admission.k8s.gatekeeper.sh rego: | package k8srequiredlabels violation[{"msg": msg, "details": {"missing_labels": missing}}] { provided := {label | input.review.object.metadata.labels[label]} required := {label | label := input.parameters.labels[_]} missing := required - provided count(missing) > 0 msg := sprintf("you must provide labels: %v", [missing]) } apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sRequiredLabels metadata: name: ns-must-have-gk spec: match: kinds: - apiGroups: [""] kinds: ["Namespace"] parameters: labels: ["gatekeeper"]

Slide 24

Slide 24 text

25 ©2021 VMware, Inc. Gatekeeper Policy Library https://github.com/open-policy-agent/gatekeeper-library/tree/master/library General • allowedrepos • block-noodepoort-services • containerlimits • containerresouorceratios • externalip • httpsonly • imagedigests • requiredlabel • uniqingresshost • uniqueserviceselector Pod Security Policy • allow-privilege-escalatiion • apparmor • capability • flexvolume-drivers • forbidden-sysctls • fsgroup • host-filesystem • host-namespace • host-network-ports • privileged-containers • proc-mount • read-only-root-filesystem • seccomp • selinux • users • volumes

Slide 25

Slide 25 text

27 ©2021 VMware, Inc. Tanzu Mission Control -- Policies / Templates Policy Template の⼀覧

Slide 26

Slide 26 text

28 ©2021 VMware, Inc. Tanzu Mission Control -- Policies / Templates Policy Template の表⽰

Slide 27

Slide 27 text

29 ©2021 VMware, Inc. Tanzu Mission Control -- Policies / Templates Policy Template の作成

Slide 28

Slide 28 text

30 ©2021 VMware, Inc. Tanzu Mission Control -- Policy Assignments

Slide 29

Slide 29 text

31 ©2021 VMware, Inc. Tanzu Mission Control -- Policy Assignments Custom Policy Assignment 作成

Slide 30

Slide 30 text

32 ©2021 VMware, Inc. Tanzu Mission Control -- Policy Assignments Custom Policy Assignment 作成

Slide 31

Slide 31 text

33 ©2021 VMware, Inc. Tanzu Mission Control -- Policy Insights Violation の表⽰

Slide 32

Slide 32 text

34 ©2021 VMware, Inc. Tanzu Mission Control -- Policy Insights Violation の詳細表⽰

Slide 33

Slide 33 text

35 ©2021 VMware, Inc. Tanzu Mission Control Demo Policies

Slide 34

Slide 34 text

36 ©2021 VMware, Inc. 問題点 • ClusterIP と spec.externalIPs フィールドを触 れる⼈は、⾃由にトラフィックをステアリング できる 回避⽅法 • OPA で Service の spec.exterrnalIPs と spec.loadBalancerIP を許可した IP アドレス のみ許可するポリシーを適⽤する CVE-2021-8554 を TMC/OPA で回避する https://tanzu.vmware.com/content/blog/tutorial-vmware-tanzu-mission-control- kubernetes-vulnerability-cve-2021-8554

Slide 35

Slide 35 text

40 ©2021 VMware, Inc. Open Policy Agent 本家のサイト • https://www.openpolicyagent.org/ • https://github.com/open-policy-agent Tanzu Mission Control で学ぶ Open Policy Agent Part 1 〜 4 by 星野さん • https://blog.lespaulstudioplus.info/posts/tmc-demanabu-opa/ OPA Deep Dive, Kubecon NA 2019 • https://www.youtube.com/watch?v=Uj2N9S58GLU TGIK 119 Gatekeeper and OPA • https://www.youtube.com/watch?v=ZJgaGJm9NJE Styra • https://www.styra.com/ • https://academy.styra.com/ References

Slide 36

Slide 36 text

©2021 VMware, Inc. Thank You