Upgrade to Pro — share decks privately, control downloads, hide ads and more …

OPA for policy enforcement

Sibi
April 29, 2020

OPA for policy enforcement

Sibi

April 29, 2020
Tweet

More Decks by Sibi

Other Decks in Technology

Transcript

  1. OPA for policy
    OPA for policy
    enforcement
    enforcement
    Sibi Prabakaran
    April 29, 2020

    View full-size slide

  2. Agenda
    Agenda
    Overview of OPA
    Rego
    Usecases/Integra ons
    Example integra on of OPA + Python web service

    View full-size slide

  3. OPA
    OPA
    Project started in a company named Styra at 2016
    Currently an incubator project at Linux founda on
    (CNCF)
    Goal: Unify policy enforcement

    View full-size slide

  4. Overview
    Overview

    View full-size slide

  5. Rego
    Rego
    Language for wri ng policy
    Expresssions, Variables, Rules
    Itera on
    Tooling

    View full-size slide

  6. Expressions
    Expressions
    > input.servers[0].protocols[0]
    "https"
    > input.servers[0].protocols[0]
    undefined decision
    input.servers[0].id == "app"
    input.servers[0].protocols[0] == "https"

    View full-size slide

  7. Rego Variables
    Rego Variables
    hello := "world"

    View full-size slide

  8. Iteration
    Iteration
    networks = [{ "id": "net1", "public": false}, { "id": "net2",
    "public": false}]
    > networks[x]
    +---+------------------------------+
    | x | networks[x] |
    +---+------------------------------+
    | 0 | {"id":"net1","public":false} |
    | 1 | {"id":"net2","public":false} |
    +---+------------------------------+

    View full-size slide

  9. Rules
    Rules
    any_public_networks = true { # is true if...
    net := networks[_] # some network exists and..
    net.public # it is public.
    }

    View full-size slide

  10. API Integration
    API Integration
    Python code
    Rego code

    View full-size slide

  11. Experience
    Experience
    Policies
    Error messages aren’t nice
    Community
    Tooling

    View full-size slide

  12. OPA
    OPA
    Integrations
    Integrations

    View full-size slide

  13. Comparision
    Comparision
    with Sentinel
    with Sentinel
    Open Source
    Applicable more generally
    Language differences

    View full-size slide

  14. Other Stu
    Other Stu
    WASM Support
    Editor integra ons
    h ps:/
    /play.openpolicyagent.org/

    View full-size slide

  15. Haskell
    Haskell
    - Fugue Rego
    Toolkit
    h ps:/
    /github.com/fugue/fregot

    View full-size slide

  16. Questions
    Questions

    View full-size slide