SlideShare a Scribd company logo

OPA: The Cloud Native Policy Engine

•
T
Torin Sandall

This document discusses Open Policy Agent (OPA), an open source general-purpose policy engine. It provides examples of how OPA can be used to enforce various types of policies across complex environments in a flexible way. OPA treats policy decisions as separate from enforcement, stores policies and data in-memory, and uses partial evaluation and indexing to evaluate policies efficiently. It allows policies to be written declaratively using Rego and enforced for services, infrastructure, and other resources regardless of how they are implemented. The document demonstrates examples of using OPA for authorization, RBAC, and other policies across multiple domains.

Technology
1 of 60
Downloaded 148 times
1
2
3
4
5
6
7
8
9
10
11
12
13
Most read
14
Most read
15
Most read
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
@sometorin @OpenPolicyAgent Open Policy Agent
@sometorin @OpenPolicyAgent Torin Sandall @sometorin ● Open Policy Agent co-founder and core contributor ● Istio and Kubernetes policy-related features ● ❤ good restaurants Copenhagen
@sometorin @OpenPolicyAgent
@sometorin @OpenPolicyAgent
@sometorin @OpenPolicyAgent Policy decisions should be decoupled from policy enforcement.
@sometorin @OpenPolicyAgent Treat policy as a separate concern. ...just like DB, messaging, monitoring, logging, orchestration, CI/CD...
@sometorin @OpenPolicyAgent Gain better control and visibility over policy throughout your system.
@sometorin @OpenPolicyAgent Everyone is affected by policy...
@sometorin @OpenPolicyAgent "QA must sign-off on images deployed to the production namespace." "Restrict ELB changes to senior SREs that are on-call." "Analysts can read client data but PII must be redacted." "Give developers SSH access to machines listed in JIRA tickets assigned to them."
@sometorin @OpenPolicyAgent Policy enforcement is a fundamental problem for your organization.
@sometorin @OpenPolicyAgent Tribal knowledge provides NO guarantee that policies are being enforced. "Tribal knowledge" is the know-how or collective wisdom of the organization.
@sometorin @OpenPolicyAgent It is expensive and painful to maintain policy decisions that are hardcoded into the app.
@sometorin @OpenPolicyAgent Service OPA Policy (rego) Data (json) OPA is an open source, general-purpose policy engine. Policy Query Policy Decision
@sometorin @OpenPolicyAgent Decisions are decoupled from enforcement. Service OPA Policy (rego) Data (json) Policy Query Policy Decision Enforcement
@sometorin @OpenPolicyAgent OPA is a host-local cache for policy decisions. Node Service OPA Node Service OPA
@sometorin @OpenPolicyAgent Node Service OPA Node Service OPA Node Service Node Host Failures OPA Node Service Node Network Partitions OPA Network Network Fate Sharing ✔ Low latency ✔ High availability
@sometorin @OpenPolicyAgent Service OPA Policy (rego) Data (json) Policy Query Policy Decision Policy and data are stored in-memory. No runtime dependencies during enforcement. Enforcement
@sometorin @OpenPolicyAgent
@sometorin @OpenPolicyAgent details service reviews service ratings service landing page service
@sometorin @OpenPolicyAgent Demo: Authorization landingpage ratings details reviews Input { "method": "GET", "path": ["reviews", "bob"], "user": "alice" }
@sometorin @OpenPolicyAgent Demo: Authorization landingpage ratings details reviews Demo Policy "Employees can see their own reviews and the reviews of their subordinates." "Employees can see their own PII. HR can also see PII."
@sometorin @OpenPolicyAgent Declarative Language (Rego) ● Is user X allowed to call operation Y on resource Z? ● Which annotations must be added to new Deployments? ● Which users can SSH into production machines?
@sometorin @OpenPolicyAgent "Employees may read their own reviews and the reviews of their subordinates."
@sometorin @OpenPolicyAgent "Employees may read their own reviews [...]"
@sometorin @OpenPolicyAgent "Employees may read their own reviews [...]" Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"}
@sometorin @OpenPolicyAgent "Employees may read their own reviews [...]" allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"}
@sometorin @OpenPolicyAgent allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = "bob" } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"} "Employees may read their own reviews [...]"
@sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK input.user = "bob" # OK } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"} "Employees may read their own reviews [...]"
@sometorin @OpenPolicyAgent allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "Employees may read their own reviews [...]" "alice" instead of "bob"
@sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK "alice" = "bob" # FAIL } "Employees may read their own reviews [...]" Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "alice" instead of "bob"
@sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK "alice" = "bob" # FAIL } "Employees may read [...] the reviews of their subordinates." Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "alice" instead of "bob"
@sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
@sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = data.manager_of[employee_id] } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
@sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = data.manager_of["bob"] } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
@sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = "alice" } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
@sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK input.user = "alice" # OK } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
@sometorin @OpenPolicyAgent What about RBAC?
@sometorin @OpenPolicyAgent RBAC solves XX% of the problem.
@sometorin @OpenPolicyAgent RBAC is not enough. "QA must sign-off on images deployed to the production namespace." "Analysts can read client data but PII must be redacted." "Restrict employees from accessing the service outside of work hours." "Allow all HTTP requests from 10.1.2.0/24." "Restrict ELB changes to senior SREs that are on-call." "Give developers SSH access to machines listed in JIRA tickets assigned to them." "Prevent developers from running containers with privileged security contexts in the production namespace." "Workloads for euro-bank must be deployed on PCI-certified clusters in the EU."
@sometorin @OpenPolicyAgent ...but everyone knows RBAC.
@sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer
@sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user
@sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation
@sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role }
@sometorin @OpenPolicyAgent Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer Find bindings and roles that match input. This rule searches over the RBAC data. allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role }
@sometorin @OpenPolicyAgent Partial Evaluation: rules + data ⇒ simplified rules allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role } Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer Partial Eval allow = true { input.user = "bob" input.resource = "/widgets" input.operation = "write" } allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" }
@sometorin @OpenPolicyAgent allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } # Many rules (100s, 1000s) allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" } OPA builds an index from simplified rules. input.resource input.operation input.user ... ... "read" "write" "/widgets" "alice" "bob" input.resource Rule Indexing Rule Rule
@sometorin @OpenPolicyAgent OPA uses the index to quickly find applicable rules. input.resource input.operation input.user Rule ... ... Rule "read" "write" "/widgets" "alice" "bob" input.resource Query allow Input { "user": "alice", "resource": "/widgets", "operation": "read" }
@sometorin @OpenPolicyAgent OPA only evaluates applicable rules. input.resource input.operation input.user Rule ... ... Rule "read" "write" "/widgets" "alice" "bob" input.resource allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } # Many rules (100s, 1000s) allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" } OPA ignores these.
@sometorin @OpenPolicyAgent # Roles # Bindings Normal Eval (ms) With Partial Eval (ms) 250 250 5.50 0.0468 500 500 11.87 0.0591 1,000 1,000 21.64 0.0543 2,000 2,000 45.49 0.0624 blog.openpolicyagent.org Partial Evaluation https://goo.gl/X6Qu6u Rule Indexing https://goo.gl/uoSw3U
@sometorin @OpenPolicyAgent "QA must sign-off on images deployed to the production namespace." "Restrict ELB changes to senior SREs that are on-call." "Analysts can read client data but PII must be redacted." "Give developers SSH access to machines listed in JIRA tickets assigned to them."
@sometorin @OpenPolicyAgent Use OPA to enforce policy across the stack.
@sometorin @OpenPolicyAgent It's all just data. deny { is_read_operation is_pii_topic not in_pii_consumer_whitelist } operation: Read resource: name: credit-scores resourceType: Topic session: principal: principalType: User name: CN=anon_producer,O=OPA clientAddress: 172.21.0.5 deny { not metadata.labels["qa-signoff"] metadata.namespace == "prod" spec.containers[_].privileged } metadata: name: nginx-149353-bvl8q namespace: production spec: containers: - image: nginx name: nginx securityContext: privileged: true nodeName: minikube allow { input.method = "GET" input.path = ["salary", user] input.user = user } method: GET path: /salary/bob service.source: namespace: production service: landing_page service.target: namespace: production service: details user: alice allow { score = risk_budget count(plan_names["aws_iam"]) == 0 blast_radius < 500 } aws_autoscaling_group.lamb: availability_zones#: '1' availability_zones.3205: us-west-1a desired_capacity: '4' launch_configuration: kitten wait_for_capacity_timeout: 10m aws_instance.puppy: ami: ami-09b4b74c instance_type: t2.micro
@sometorin @OpenPolicyAgent ● Complex environment ○ >1,000 services ○ Many resource and identity types ○ Many protocols, languages, etc. ● Key requirements ○ Low latency ○ Flexible policies ○ Ability to capture intent ● Using OPA across the stack ○ HTTP and gRPC APIs ○ Kafka producers ○ SSH (coming soon) User Study: Netflix How Netflix is Solving Authorization Across Their Cloud (KubeCon US 2017)
@sometorin @OpenPolicyAgent orchestrator API ssh app host container dbcloud 20+ companies using OPA. Financial institutions, service providers, IT companies, software vendors, etc. Used across the stack. Microservices, orchestration, provisioning, host daemons, data layer, security groups, etc. Bring more use cases. RBAC, ABAC, admission control, data protection, risk management, rate liming, auditing, etc.
@sometorin @OpenPolicyAgent Demo
@sometorin @OpenPolicyAgent Policy decisions should be decoupled from policy enforcement.
@sometorin @OpenPolicyAgent Try tutorials at openpolicyagent.org HTTP API Authorization Admission Control Risk Management SSH and sudoData Protection
@sometorin @OpenPolicyAgent Leverage OPA to solve fundamental policy and security problems.
@sometorin @OpenPolicyAgent Thank You! open-policy-agent/opa Star us on GitHub.

More Related Content

PDF
Rego Deep Dive
Torin Sandall
 
PPTX
RedisConf17- Using Redis at scale @ Twitter
Redis Labs
 
PDF
Open Policy Agent
Torin Sandall
 
PPTX
Reusable, composable, battle-tested Terraform modules
Yevgeniy Brikman
 
PDF
Running Apache Spark on Kubernetes: Best Practices and Pitfalls
Databricks
 
PDF
OpenSearch.pdf
Abhi Jain
 
PDF
Distributed tracing using open tracing &amp; jaeger 2
Chandresh Pancholi
 
PDF
Optimizing Kubernetes Resource Requests/Limits for Cost-Efficiency and Latenc...
Henning Jacobs
 
Rego Deep Dive
Torin Sandall
 
RedisConf17- Using Redis at scale @ Twitter
Redis Labs
 
Open Policy Agent
Torin Sandall
 
Reusable, composable, battle-tested Terraform modules
Yevgeniy Brikman
 
Running Apache Spark on Kubernetes: Best Practices and Pitfalls
Databricks
 
OpenSearch.pdf
Abhi Jain
 
Distributed tracing using open tracing &amp; jaeger 2
Chandresh Pancholi
 
Optimizing Kubernetes Resource Requests/Limits for Cost-Efficiency and Latenc...
Henning Jacobs
 

What's hot (20)

PDF
Introduction to OPA
Knoldus Inc.
 
PPTX
Securing APIs with Open Policy Agent
Nordic APIs
 
PDF
Open Policy Agent Deep Dive Seattle 2018
Torin Sandall
 
PDF
How Netflix Is Solving Authorization Across Their Cloud
Torin Sandall
 
PDF
Enforcing Bespoke Policies in Kubernetes
Torin Sandall
 
PDF
Implementing Authorization
Torin Sandall
 
PDF
엘라스틱서치, 로그스태시, 키바나
종민 김
 
PPTX
Building secure applications with keycloak
Abhishek Koserwal
 
PDF
Kubernetes Security with Calico and Open Policy Agent
CloudOps2005
 
PPTX
Elk
Caleb Wang
 
PPTX
Monitoring With Prometheus
Agile Testing Alliance
 
PDF
Istio's mixer policy enforcement with custom adapters (cloud nativecon 17)
Torin Sandall
 
PDF
MongoDB World 2019: Tips and Tricks++ for Querying and Indexing MongoDB
MongoDB
 
PDF
OAuth 2.0
Uwe Friedrichsen
 
KEY
JSON-LD: JSON for Linked Data
Gregg Kellogg
 
PPTX
OPA APIs and Use Case Survey
Torin Sandall
 
PDF
JSON-LD: JSON for the Social Web
Gregg Kellogg
 
PPTX
Introduction to ELK
YuHsuan Chen
 
PPTX
Hydra: A Vocabulary for Hypermedia-Driven Web APIs
Markus Lanthaler
 
PPT
OpenSearch
hchen1
 
Introduction to OPA
Knoldus Inc.
 
Securing APIs with Open Policy Agent
Nordic APIs
 
Open Policy Agent Deep Dive Seattle 2018
Torin Sandall
 
How Netflix Is Solving Authorization Across Their Cloud
Torin Sandall
 
Enforcing Bespoke Policies in Kubernetes
Torin Sandall
 
Implementing Authorization
Torin Sandall
 
엘라스틱서치, 로그스태시, 키바나
종민 김
 
Building secure applications with keycloak
Abhishek Koserwal
 
Kubernetes Security with Calico and Open Policy Agent
CloudOps2005
 
Elk
Caleb Wang
 
Monitoring With Prometheus
Agile Testing Alliance
 
Istio's mixer policy enforcement with custom adapters (cloud nativecon 17)
Torin Sandall
 
MongoDB World 2019: Tips and Tricks++ for Querying and Indexing MongoDB
MongoDB
 
OAuth 2.0
Uwe Friedrichsen
 
JSON-LD: JSON for Linked Data
Gregg Kellogg
 
OPA APIs and Use Case Survey
Torin Sandall
 
JSON-LD: JSON for the Social Web
Gregg Kellogg
 
Introduction to ELK
YuHsuan Chen
 
Hydra: A Vocabulary for Hypermedia-Driven Web APIs
Markus Lanthaler
 
OpenSearch
hchen1
 
Ad

Similar to OPA: The Cloud Native Policy Engine (20)

PDF
Dynamic Authorization & Policy Control for Docker Environments
Torin Sandall
 
PPTX
Securing APIs with Open Policy Agent
Anders Eknert
 
PPTX
Cloud native policy enforcement with Open Policy Agent
LibbySchulze
 
PDF
DSO-LG 2021 Reboot: Policy As Code (Anders Eknert)
Michael Man
 
PDF
CNCF opa
Juraj Hantak
 
PDF
Opa in the api management world
Red Hat
 
PPTX
Externalizing Authorization in Micro Services world
Sitaraman Lakshminarayanan
 
PDF
Protecting the Data Lake
Ashutosh Narkar
 
PDF
Securing the Message Bus with Kafka Streams | Paul Otto and Ryan Salcido, Raf...
HostedbyConfluent
 
PDF
OPA open policy agent
Knoldus Inc.
 
PDF
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays
 
PPTX
Opa microservice authorization
Anders Eknert
 
PDF
A Policy-as-Code Approach to RBAC Authorization - by Graziano Casto, MIa-Pla...
Nordic APIs
 
PDF
Dynamic Policy Enforcement for Microservice Environments
Nebulaworks
 
PDF
Cloud Native User Group: Shift-Left Testing IaC With PaC
smalltown
 
PDF
fwd:cloudsec 2022: Shifting right with policy-as-code
Gabriel Schuyler
 
PDF
Ronen Levinson: Unified policy enforcement with opa - Architecture Next 20
CodeValue
 
PDF
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
LibbySchulze
 
PDF
apidays Helsinki & North 2023 - API authorization with Open Policy Agent, And...
apidays
 
PDF
Distributed Authorization with Open Policy Agent.pdf
Nordic APIs
 
Dynamic Authorization & Policy Control for Docker Environments
Torin Sandall
 
Securing APIs with Open Policy Agent
Anders Eknert
 
Cloud native policy enforcement with Open Policy Agent
LibbySchulze
 
DSO-LG 2021 Reboot: Policy As Code (Anders Eknert)
Michael Man
 
CNCF opa
Juraj Hantak
 
Opa in the api management world
Red Hat
 
Externalizing Authorization in Micro Services world
Sitaraman Lakshminarayanan
 
Protecting the Data Lake
Ashutosh Narkar
 
Securing the Message Bus with Kafka Streams | Paul Otto and Ryan Salcido, Raf...
HostedbyConfluent
 
OPA open policy agent
Knoldus Inc.
 
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays
 
Opa microservice authorization
Anders Eknert
 
A Policy-as-Code Approach to RBAC Authorization - by Graziano Casto, MIa-Pla...
Nordic APIs
 
Dynamic Policy Enforcement for Microservice Environments
Nebulaworks
 
Cloud Native User Group: Shift-Left Testing IaC With PaC
smalltown
 
fwd:cloudsec 2022: Shifting right with policy-as-code
Gabriel Schuyler
 
Ronen Levinson: Unified policy enforcement with opa - Architecture Next 20
CodeValue
 
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
LibbySchulze
 
apidays Helsinki & North 2023 - API authorization with Open Policy Agent, And...
apidays
 
Distributed Authorization with Open Policy Agent.pdf
Nordic APIs
 
Ad

Recently uploaded (20)

PDF
Doc9.....................................
SofiaCollazos
 
PDF
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
PDF
Unlocking the Future- AI Agents Meet Oracle Database 23ai - AIOUG Yatra 2025.pdf
Sandesh Rao
 
PDF
MASTERDECK GRAPHSUMMIT SYDNEY (Public).pdf
Neo4j
 
PPTX
Introduction to Flutter by Ayush Desai.pptx
ayushdesai204
 
PDF
Structs to JSON: How Go Powers REST APIs
Emily Achieng
 
PPTX
Agile Chennai 18-19 July 2025 | Emerging patterns in Agentic AI by Bharani Su...
AgileNetwork
 
PPTX
Dev Dives: Automate, test, and deploy in one place—with Unified Developer Exp...
AndreeaTom
 
PDF
Accelerating Oracle Database 23ai Troubleshooting with Oracle AHF Fleet Insig...
Sandesh Rao
 
PDF
A Strategic Analysis of the MVNO Wave in Emerging Markets.pdf
IPLOOK Networks
 
PDF
GDG Cloud Munich - Intro - Luiz Carneiro - #BuildWithAI - July - Abdel.pdf
Luiz Carneiro
 
PPTX
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
PDF
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
PPTX
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
PPTX
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
PDF
Brief History of Internet - Early Days of Internet
sutharharshit158
 
PDF
Trying to figure out MCP by actually building an app from scratch with open s...
Julien SIMON
 
PDF
CIFDAQ's Market Wrap : Bears Back in Control?
CIFDAQ
 
PPTX
AI and Robotics for Human Well-being.pptx
JAYMIN SUTHAR
 
PDF
AI-Cloud-Business-Management-Platforms-The-Key-to-Efficiency-Growth.pdf
Artjoker Software Development Company
 
Doc9.....................................
SofiaCollazos
 
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
Unlocking the Future- AI Agents Meet Oracle Database 23ai - AIOUG Yatra 2025.pdf
Sandesh Rao
 
MASTERDECK GRAPHSUMMIT SYDNEY (Public).pdf
Neo4j
 
Introduction to Flutter by Ayush Desai.pptx
ayushdesai204
 
Structs to JSON: How Go Powers REST APIs
Emily Achieng
 
Agile Chennai 18-19 July 2025 | Emerging patterns in Agentic AI by Bharani Su...
AgileNetwork
 
Dev Dives: Automate, test, and deploy in one place—with Unified Developer Exp...
AndreeaTom
 
Accelerating Oracle Database 23ai Troubleshooting with Oracle AHF Fleet Insig...
Sandesh Rao
 
A Strategic Analysis of the MVNO Wave in Emerging Markets.pdf
IPLOOK Networks
 
GDG Cloud Munich - Intro - Luiz Carneiro - #BuildWithAI - July - Abdel.pdf
Luiz Carneiro
 
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
Brief History of Internet - Early Days of Internet
sutharharshit158
 
Trying to figure out MCP by actually building an app from scratch with open s...
Julien SIMON
 
CIFDAQ's Market Wrap : Bears Back in Control?
CIFDAQ
 
AI and Robotics for Human Well-being.pptx
JAYMIN SUTHAR
 
AI-Cloud-Business-Management-Platforms-The-Key-to-Efficiency-Growth.pdf
Artjoker Software Development Company
 

OPA: The Cloud Native Policy Engine

  • 2. @sometorin @OpenPolicyAgent Torin Sandall @sometorin ● Open Policy Agent co-founder and core contributor ● Istio and Kubernetes policy-related features ● ❤ good restaurants Copenhagen
  • 5. @sometorin @OpenPolicyAgent Policy decisions should be decoupled from policy enforcement.
  • 6. @sometorin @OpenPolicyAgent Treat policy as a separate concern. ...just like DB, messaging, monitoring, logging, orchestration, CI/CD...
  • 7. @sometorin @OpenPolicyAgent Gain better control and visibility over policy throughout your system.
  • 9. @sometorin @OpenPolicyAgent "QA must sign-off on images deployed to the production namespace." "Restrict ELB changes to senior SREs that are on-call." "Analysts can read client data but PII must be redacted." "Give developers SSH access to machines listed in JIRA tickets assigned to them."
  • 10. @sometorin @OpenPolicyAgent Policy enforcement is a fundamental problem for your organization.
  • 11. @sometorin @OpenPolicyAgent Tribal knowledge provides NO guarantee that policies are being enforced. "Tribal knowledge" is the know-how or collective wisdom of the organization.
  • 12. @sometorin @OpenPolicyAgent It is expensive and painful to maintain policy decisions that are hardcoded into the app.
  • 13. @sometorin @OpenPolicyAgent Service OPA Policy (rego) Data (json) OPA is an open source, general-purpose policy engine. Policy Query Policy Decision
  • 14. @sometorin @OpenPolicyAgent Decisions are decoupled from enforcement. Service OPA Policy (rego) Data (json) Policy Query Policy Decision Enforcement
  • 15. @sometorin @OpenPolicyAgent OPA is a host-local cache for policy decisions. Node Service OPA Node Service OPA
  • 16. @sometorin @OpenPolicyAgent Node Service OPA Node Service OPA Node Service Node Host Failures OPA Node Service Node Network Partitions OPA Network Network Fate Sharing ✔ Low latency ✔ High availability
  • 17. @sometorin @OpenPolicyAgent Service OPA Policy (rego) Data (json) Policy Query Policy Decision Policy and data are stored in-memory. No runtime dependencies during enforcement. Enforcement
  • 19. @sometorin @OpenPolicyAgent details service reviews service ratings service landing page service
  • 21. @sometorin @OpenPolicyAgent Demo: Authorization landingpage ratings details reviews Demo Policy "Employees can see their own reviews and the reviews of their subordinates." "Employees can see their own PII. HR can also see PII."
  • 22. @sometorin @OpenPolicyAgent Declarative Language (Rego) ● Is user X allowed to call operation Y on resource Z? ● Which annotations must be added to new Deployments? ● Which users can SSH into production machines?
  • 23. @sometorin @OpenPolicyAgent "Employees may read their own reviews and the reviews of their subordinates."
  • 24. @sometorin @OpenPolicyAgent "Employees may read their own reviews [...]"
  • 25. @sometorin @OpenPolicyAgent "Employees may read their own reviews [...]" Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"}
  • 26. @sometorin @OpenPolicyAgent "Employees may read their own reviews [...]" allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"}
  • 27. @sometorin @OpenPolicyAgent allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = "bob" } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"} "Employees may read their own reviews [...]"
  • 28. @sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK input.user = "bob" # OK } Input {"method": "GET", "path": ["reviews", "bob"], "user": "bob"} "Employees may read their own reviews [...]"
  • 29. @sometorin @OpenPolicyAgent allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "Employees may read their own reviews [...]" "alice" instead of "bob"
  • 30. @sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK "alice" = "bob" # FAIL } "Employees may read their own reviews [...]" Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "alice" instead of "bob"
  • 31. @sometorin @OpenPolicyAgent allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK "alice" = "bob" # FAIL } "Employees may read [...] the reviews of their subordinates." Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} "alice" instead of "bob"
  • 32. @sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
  • 33. @sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = data.manager_of[employee_id] } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
  • 34. @sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = data.manager_of["bob"] } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
  • 35. @sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" input.path = ["reviews", "bob"] input.user = "alice" } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
  • 36. @sometorin @OpenPolicyAgent "Employees may read [...] the reviews of their subordinates." allow = true { input.method = "GET" input.path = ["reviews", employee_id] input.user = employee_id } allow = true { input.method = "GET" # OK input.path = ["reviews", "bob"] # OK input.user = "alice" # OK } Input {"method": "GET", "path": ["reviews", "bob"], "user": "alice"} Data (in-memory) {"manager_of": { "bob": "alice", "alice": "janet"}}
  • 39. @sometorin @OpenPolicyAgent RBAC is not enough. "QA must sign-off on images deployed to the production namespace." "Analysts can read client data but PII must be redacted." "Restrict employees from accessing the service outside of work hours." "Allow all HTTP requests from 10.1.2.0/24." "Restrict ELB changes to senior SREs that are on-call." "Give developers SSH access to machines listed in JIRA tickets assigned to them." "Prevent developers from running containers with privileged security contexts in the production namespace." "Workloads for euro-bank must be deployed on PCI-certified clusters in the EU."
  • 41. @sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer
  • 42. @sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user
  • 43. @sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation
  • 44. @sometorin @OpenPolicyAgent Implement RBAC with OPA. Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role }
  • 45. @sometorin @OpenPolicyAgent Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer Find bindings and roles that match input. This rule searches over the RBAC data. allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role }
  • 46. @sometorin @OpenPolicyAgent Partial Evaluation: rules + data ⇒ simplified rules allow = true { # Find binding(s) for user. binding := data.bindings[_] input.user = binding.user # Find role(s) with permission. role := data.roles[_] input.resource = role.resource input.operation = role.operation # Check if binding matches role. role.name = binding.role } Data (in-memory) bindings: - user: inspector-alice role: widget-reader - user: maker-bob role: widget-writer roles: - operation: read resource: widgets name: widget-reader - operation: write resource: widgets name: widget-writer Partial Eval allow = true { input.user = "bob" input.resource = "/widgets" input.operation = "write" } allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" }
  • 47. @sometorin @OpenPolicyAgent allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } # Many rules (100s, 1000s) allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" } OPA builds an index from simplified rules. input.resource input.operation input.user ... ... "read" "write" "/widgets" "alice" "bob" input.resource Rule Indexing Rule Rule
  • 48. @sometorin @OpenPolicyAgent OPA uses the index to quickly find applicable rules. input.resource input.operation input.user Rule ... ... Rule "read" "write" "/widgets" "alice" "bob" input.resource Query allow Input { "user": "alice", "resource": "/widgets", "operation": "read" }
  • 49. @sometorin @OpenPolicyAgent OPA only evaluates applicable rules. input.resource input.operation input.user Rule ... ... Rule "read" "write" "/widgets" "alice" "bob" input.resource allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } allow = true { ... } # Many rules (100s, 1000s) allow = true { input.user = "alice" input.resource = "/widgets" input.operation = "read" } OPA ignores these.
  • 50. @sometorin @OpenPolicyAgent # Roles # Bindings Normal Eval (ms) With Partial Eval (ms) 250 250 5.50 0.0468 500 500 11.87 0.0591 1,000 1,000 21.64 0.0543 2,000 2,000 45.49 0.0624 blog.openpolicyagent.org Partial Evaluation https://goo.gl/X6Qu6u Rule Indexing https://goo.gl/uoSw3U
  • 51. @sometorin @OpenPolicyAgent "QA must sign-off on images deployed to the production namespace." "Restrict ELB changes to senior SREs that are on-call." "Analysts can read client data but PII must be redacted." "Give developers SSH access to machines listed in JIRA tickets assigned to them."
  • 52. @sometorin @OpenPolicyAgent Use OPA to enforce policy across the stack.
  • 53. @sometorin @OpenPolicyAgent It's all just data. deny { is_read_operation is_pii_topic not in_pii_consumer_whitelist } operation: Read resource: name: credit-scores resourceType: Topic session: principal: principalType: User name: CN=anon_producer,O=OPA clientAddress: 172.21.0.5 deny { not metadata.labels["qa-signoff"] metadata.namespace == "prod" spec.containers[_].privileged } metadata: name: nginx-149353-bvl8q namespace: production spec: containers: - image: nginx name: nginx securityContext: privileged: true nodeName: minikube allow { input.method = "GET" input.path = ["salary", user] input.user = user } method: GET path: /salary/bob service.source: namespace: production service: landing_page service.target: namespace: production service: details user: alice allow { score = risk_budget count(plan_names["aws_iam"]) == 0 blast_radius < 500 } aws_autoscaling_group.lamb: availability_zones#: '1' availability_zones.3205: us-west-1a desired_capacity: '4' launch_configuration: kitten wait_for_capacity_timeout: 10m aws_instance.puppy: ami: ami-09b4b74c instance_type: t2.micro
  • 54. @sometorin @OpenPolicyAgent ● Complex environment ○ >1,000 services ○ Many resource and identity types ○ Many protocols, languages, etc. ● Key requirements ○ Low latency ○ Flexible policies ○ Ability to capture intent ● Using OPA across the stack ○ HTTP and gRPC APIs ○ Kafka producers ○ SSH (coming soon) User Study: Netflix How Netflix is Solving Authorization Across Their Cloud (KubeCon US 2017)
  • 55. @sometorin @OpenPolicyAgent orchestrator API ssh app host container dbcloud 20+ companies using OPA. Financial institutions, service providers, IT companies, software vendors, etc. Used across the stack. Microservices, orchestration, provisioning, host daemons, data layer, security groups, etc. Bring more use cases. RBAC, ABAC, admission control, data protection, risk management, rate liming, auditing, etc.
  • 57. @sometorin @OpenPolicyAgent Policy decisions should be decoupled from policy enforcement.
  • 58. @sometorin @OpenPolicyAgent Try tutorials at openpolicyagent.org HTTP API Authorization Admission Control Risk Management SSH and sudoData Protection
  • 59. @sometorin @OpenPolicyAgent Leverage OPA to solve fundamental policy and security problems.