OPA for policy enforcement

Transcript

1. OPA for policy
   OPA for policy
   enforcement
   enforcement
   Sibi Prabakaran
   April 29, 2020
   

   View Slide

2. Agenda
   Agenda
   Overview of OPA
   Rego
   Usecases/Integra ons
   Example integra on of OPA + Python web service
   

   View Slide

3. OPA
   OPA
   Project started in a company named Styra at 2016
   Currently an incubator project at Linux founda on
   (CNCF)
   Goal: Unify policy enforcement
   

   View Slide

4. Overview
   Overview
   

   View Slide

5. Rego
   Rego
   Language for wri ng policy
   Expresssions, Variables, Rules
   Itera on
   Tooling
   

   View Slide

6. Expressions
   Expressions
   > input.servers[0].protocols[0]
   "https"
   > input.servers[0].protocols[0]
   undefined decision
   input.servers[0].id == "app"
   input.servers[0].protocols[0] == "https"
   

   View Slide

7. Rego Variables
   Rego Variables
   hello := "world"
   

   View Slide

8. Iteration
   Iteration
   networks = [{ "id": "net1", "public": false}, { "id": "net2",
   "public": false}]
   > networks[x]
   +---+------------------------------+
   | x | networks[x] |
   +---+------------------------------+
   | 0 | {"id":"net1","public":false} |
   | 1 | {"id":"net2","public":false} |
   +---+------------------------------+
   

   View Slide

9. Rules
   Rules
   any_public_networks = true { # is true if...
   net := networks[_] # some network exists and..
   net.public # it is public.
   }
   

   View Slide

10. API Integration
    API Integration
    Python code
    Rego code
    

    View Slide

11. Experience
    Experience
    Policies
    Error messages aren’t nice
    Community
    Tooling
    

    View Slide

12. OPA
    OPA
    Integrations
    Integrations
    

    View Slide

13. Comparision
    Comparision
    with Sentinel
    with Sentinel
    Open Source
    Applicable more generally
    Language differences
    

    View Slide

14. Other Stu
    Other Stu
    WASM Support
    Editor integra ons
    h ps:/
    /play.openpolicyagent.org/
    

    View Slide

15. Haskell
    Haskell
    - Fugue Rego
    Toolkit
    h ps:/
    /github.com/fugue/fregot
    

    View Slide

16. Questions
    Questions
    

    View Slide