OPA for policy enforcement

A513bc1fa519d2fcf5e4e0d9b5500101?s=47 Sibi
April 29, 2020

OPA for policy enforcement

A513bc1fa519d2fcf5e4e0d9b5500101?s=128

Sibi

April 29, 2020
Tweet

Transcript

  1. OPA for policy OPA for policy enforcement enforcement Sibi Prabakaran

    April 29, 2020
  2. Agenda Agenda Overview of OPA Rego Usecases/Integra ons Example integra

    on of OPA + Python web service
  3. OPA OPA Project started in a company named Styra at

    2016 Currently an incubator project at Linux founda on (CNCF) Goal: Unify policy enforcement
  4. Overview Overview

  5. Rego Rego Language for wri ng policy Expresssions, Variables, Rules

    Itera on Tooling
  6. Expressions Expressions > input.servers[0].protocols[0] "https" > input.servers[0].protocols[0] undefined decision input.servers[0].id

    == "app" input.servers[0].protocols[0] == "https"
  7. Rego Variables Rego Variables hello := "world"

  8. Iteration Iteration networks = [{ "id": "net1", "public": false}, {

    "id": "net2", "public": false}] > networks[x] +---+------------------------------+ | x | networks[x] | +---+------------------------------+ | 0 | {"id":"net1","public":false} | | 1 | {"id":"net2","public":false} | +---+------------------------------+
  9. Rules Rules any_public_networks = true { # is true if...

    net := networks[_] # some network exists and.. net.public # it is public. }
  10. API Integration API Integration Python code Rego code

  11. Experience Experience Policies Error messages aren’t nice Community Tooling

  12. OPA OPA Integrations Integrations

  13. Comparision Comparision with Sentinel with Sentinel Open Source Applicable more

    generally Language differences
  14. Other Stu Other Stu WASM Support Editor integra ons h

    ps:/ /play.openpolicyagent.org/
  15. Haskell Haskell - Fugue Rego Toolkit h ps:/ /github.com/fugue/fregot

  16. Questions Questions