Open Policy Agent (OPA) is a general purpose policy engine that can be used to enforce policies across cloud native applications and infrastructure. It decouples policy from application logic by offloading policy decisions. REGO is OPA's declarative language used to write policies. OPA has over 30 integrations and is widely used for Kubernetes policy enforcement through the Gatekeeper project.

1. Open Policy Agent
Introduction

2. Labyrinth Labs is a boutique expert shop
focusing on DevOps, Public Cloud and
Kubernetes ecosystem.
Our mission is to help companies evolve
their applications into the containerized
and serverless future.
We are a privately owned company mainly
driven by technical excellence
and our passion in modern application
technologies.
About us

3. Agenda
● Introduction
● Policy decision model
● Interactions with OPA
● Rego basics
● Performance
● Ecosystem
● Gatekeeper example

4. Open Policy Agent
Introduction

5. OPA - Overview
● General purpose policy engine
● Decouples policy from application logic
● Offload policy decision-making from your software
to enforce policies
● Toolset and framework for policy across the cloud
native stack
● Declarative Policy as a Code with REGO

6. OPA - Community
● CNCF graduated
● 30+ integrations
● Vibrant community
● Good tooling and ecosystems
● Users

7. Policy Decision Model

8. OPA - Operational Model
● Service query OPA with
structured data
● Based on policy and data OPA
evaluates query
● Returns decision as response
with structured data to the
service

9. OPA - Data Model
● Data classification
○ Base documents
○ Virtual documents

10. OPA - External Data
● Data size
● Update frequency
● Consistency model
● Loading options:
○ Sync push
○ Sync push overload
○ Periodic pull - Bundle API
○ Async push data
○ Pull data during evaluation

11. OPA - External Data
● Sync push - base document
○ updates
○ size
● Usage:
○ User attributes

12. OPA - External Data
● Sync push overload - base
document
○ updates
○ size
● Usage:
○ Local & Dynamic data

13. OPA - External Data
● Bundle API
○ updates
○ size
○ consistency
○ persistency
● Usage:
○ Static & Medium-sized
data

14. OPA - External Data
● Push data
○ updates
○ size
● Usage:
○ Dynamic & Medium-sized
data

15. OPA - External Data
● Pull data during evaluation
○ updates
○ size
○ performance
● Usage:
○ Dynamic & Large-sized
data

16. OPA - APIs
● Policy
● Data
● Query
● Compile
● Auth
● Trace
● Metrics
● Config

17. OPA - Policy API

18. OPA - Data API

19. OPA - Query API
Policy Request Resposne
POST / == POST /system/main

20. Interactions

21. OPA - Interactions
● Command line (+interactive mode)
● Library
● Server (HTTP)
○ Sidecar
○ Host-level daemon
○ Distributed service

22. REGO Language

23. OPA - REGO Language
● Inspired by Datalog
● Relatively easy for reading / writing
● Declarative

24. OPA - REGO Example
● Pet Store example with RBAC policy

25. OPA - Rich set of primitives
● Arrays / Objects / Sets
○ lookups, iterations
○ concat, …, unions
● Rules, functions
○ conditionals, incremental, else
● Comparisons, Math
● String manipulations, regexp, …
● Many more

26. Performance

27. OPA - Performance
● Evaluation budget order of 1 ms
● Linear fragment
● Use objects over arrays

28. OPA - Performance partial evaluation

29. OPA - Performance indexing statements

30. OPA - Performance comprehension Indexing

31. OPA - Performance envoy example

32. Ecosystem

33. OPA - Integrations

34. OPA - Roadmap

35. OPA - Tooling
● OPA cli
○ eval
○ bench
○ fmt
○ check
● VS code, IntelliJ plugins
● conftest
● terrascan
● OPAL
● rego playground

36. OPA - inspiration
● terrascan rego
● gatekeeper library
● scalr sample policies
● OPA PoC & contributions

37. Examples
-
Kubernetes Gatekeeper

38. OPA - Gatekeeper

39. OPA - Gatekeeper

40. OPA - Gatekeeper policy enforcement

41. OPA - Gatekeeper audit

42. OPA - Gatekeeper Library General
● K8sAllowedRepos
● K8sBlockNodePort
● K8sContainerLimits
● K8sContainerRatios
● K8sDisallowedTags
● K8sHttpsOnly
● K8sImageDigests
● K8sRequiredLabels
● K8sRequiredProbes
● K8sUniqueIngressHost
● K8sUniqueIngressHost
● K8sExternalIPs

43. OPA - Gatekeeper PSP replacement

44. Thank you
Martin Dojcak
CTO & Co-founder
Contact:
martin.dojcak@lablabs.io