OPA APIs and Use Case Survey

Open Policy Agent
API and Use Case Survey

openpolicyagent.org
Policy Management Fabric
(Out of scope for OPA)
Goals and Non-goals
OPA
OPA OPA
OPA
OPA’s Goal: policy-enable other projects and services, regardless of domain
● Run at the edge to make policy decisions for host-local consumers
● Zero runtime dependencies
● Easy integrations

openpolicyagent.org
OPA is an open source, general-purpose policy engine

openpolicyagent.org
● Declarative Language (Rego)
○ Is X allowed to call operation Y on resource Z?
○ Which users can SSH into production hosts?
○ What clusters should workload X be deployed to?
○ What annotations must be set on object X?

openpolicyagent.org
● Library/Daemon (Go)
○ In-memory storage of data and policies
○ Zero runtime dependencies
○ Evaluation engine: parser, compiler, interpreter
○ Tooling: REPL, test framework, tracing

openpolicyagent.org
● Library/Daemon (Go)
○ In-memory storage of data and policies
○ Zero runtime dependencies
○ Evaluation engine: parser, compiler, interpreter
○ Tooling: REPL, test framework, tracing
● Standard Library & Integrations
○ Authorization, admission control, auditing, etc.
○ Kubernetes, Istio, AWS, Terraform, Docker, and more.

openpolicyagent.org
DataLogic
Management API:
Management pushes updates
Enforcement API:
Service requests decision

openpolicyagent.org
DataLogic
Management API:
Management pushes updates
Enforcement API:
Service requests decision
Service-specific
Management sidecar

openpolicyagent.org
Enforcement + Management API (REST)
List all policies GET /v2/policies
Insert, modify, delete policies GET/PUT/DELETE /v2/policies/<path>
List all data GET /v2/data
Insert, modify, delete raw data GET/PUT/PATCH/DELETE /v2/data/<path>
Get policy decision GET/POST /v2/decisions/<path>
?metrics
?watch
?explain
include metrics (ex: latency)
stream updates
explain why result is true
(Tim’s proposal for v2--a small change from v1.)
Management API
Enforcement API

History
2016: Inception
Requirements
● Decisions about JSON
● Decisions are JSON
● Ease of integration
● Host-local agent
Execution
● New language: Rego
● HTTP API over localhost
● Go binary
2017: Application
Requirements
● Solve real problems
● Build community
● Learn requirements
● Hill-climb implementation
Execution
● Domains: Cloud, Server,
Container, Microservices
● Customers, KubeCon,
CNCF, Meetups, ...
2018: Hardening
Requirements
● Ease of use
● Performance
● Solve real problems
● Build community
Execution
● v2 of Language/API/Engine
● Leverage Google’s CEL
● Policy Library
● CNCF, Conferences, Users
Today

openpolicyagent.org
Use Cases
OPA
Cloud
Orchestrator
Risk Management
Linux
Container Execution, SSH, sudo
OPA
Hashicorp
Terraform
OPA
Microservice APIs
Istio Linkerd
OPA
Container
Placement &
Admission Control
OPA
Data protection

openpolicyagent.org
Dimensions for Use Case Comparison
● Policy
○ What kind of policy?
○ What kind of expressiveness? Iteration, etc.
● Data/context
○ OPA treats data separate from policy
○ What data does the policy depend on?
○ How does OPA know about that data?
● Decisions
○ Are decisions booleans/strings/numbers/arrays/maps?
● Integration
○ How was the enforcement integration done?
● Policy management
○ How were policies/data pushed into OPA?
● Performance
○ How many queries per second are required?
● Mode
○ Proactive (prevent violations), reactive (fix violations), audit (identify violations)

openpolicyagent.org
Use Cases
OPA
Cloud
Orchestrator
Risk Management
Linux
OPA
Hashicorp
Terraform
OPA
Microservice APIs
Istio Linkerd
OPA
Placement &
Admission Control
OPA
Data protection

openpolicyagent.org
Use Cases: Kubernetes
apiserver
authorization admission control
scheduler
federation control plane
OPA
OPAOPA
OPA
Current Use Cases
● Federated Workload Placement
● Pod Scheduling
● Authorization
● Admission Control
● Audit
Future Use Cases
● Storage policy (in progress)
● Network policy
controllers
nodes

openpolicyagent.org
Use Cases: Kubernetes: Admission Control
apiserver
admission controllers
quota execwebhook
metadata:
name: frontend
labels:
contact: name@example.com
spec:
replicas: 5
selector:
app: frontend
template:
metadata:
name: frontend
labels:
app: frontend
spec:
containers:
- name: proxy
image: nginx
kubectl apply -f app.yaml
OPA

openpolicyagent.org
Use Cases: Kubernetes: Admission Control Policy
kind: Pod
metadata:
labels:
app: nginx
name: nginx-1493591563-bvl8q
namespace: production
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
dnsPolicy: ClusterFirst
nodeName: minikube
restartPolicy: Always
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references
spec.containers[0].image
# variables and iteration
container := spec.containers[index]
# expressions
container.securityContext.privileged == true
# functions
is_privileged(container) {
container.securityContext.privileged == true
}
# rules
deny {
review.user == “bob”
review.operation == “CREATE”
review.namespace == “production”
is_privileged(spec.containers[_])
}

openpolicyagent.org
Use Cases: Kubernetes: Admission Control Decision
Policy Query
POST opa:8181/v1/data/k8s/admission/allow
input:
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
Policy Decision
200 OK
{
“result”: true
}
Policy decision can also be a
JSON-patch-like dictionary
describing updates to pod.

openpolicyagent.org
Example Policies
● Images may only be pulled from internal registry
● Only scanned images may be deployed in
namespaces A, B, and C
● QA team must sign-off on image before deployed to
production
● Stateful deployments must use ‘recreate’ update
strategy
● Developers must not modify selectors or labels
referred to by selectors after creation
● Containers must have CPU and memory resource
requests and limits set
● Containers cannot run with privileged security
context
● Services in namespace X should have AWS SSL
annotation added
apiserver
admission control
OPA

openpolicyagent.org
Use Cases: Kubernetes
● Cluster placement
○ Policy: choose clusters a workload should be deployed to. JSON pointer for analyzing request
○ Data: Depends on cluster metadata (mirrored from k8s)
○ Decision: set of clusters
○ Integration: webhook hardcoded to ask GET /
○ Policy management: K8s ConfigMaps
○ Mode: proactive, reactive, audit
○ Performance: 1s
● Admission control
○ Policy: authorization + modification of incoming request. JSON pointer for analyzing request
○ Data: Depends on pod metadata (mirrored from k8s)
○ Decision: JSON patch describing changes
○ Integration: webhook hardcoded to ask GET /
○ Policy management: k8s ConfigMaps
○ Mode: proactive, reactive, audit
○ Performance: 1s

openpolicyagent.org
Use Cases
OPA
Cloud
OPA Orchestrator
Risk Management
Placement &
Admission Control
Linux
OPA
Hashicorp
Terraform
OPA
Microservice APIs
Istio Linkerd
OPA
Data protection

openpolicyagent.org
Use Cases: Microservice APIs
ratingsreviews
details
landing_page
GET /reviews/{id}
GET /details/{id}
GET /ratings/{id}
OPA
OPA
OPA OPA

openpolicyagent.org
details
ratings
Policy Query
POST opa:8181/v1/data/example/allow
{
“input”: {
“path”: [“details”, “bob”],
“method”: “GET”,
“source”: “landing_page”,
“target”: “details”,
“query_params”: {},
“user”: “alice”,
“body”: null
}
}
Policy Decision
200 OK
{
“result”: true
}
detailsdetails
reviews
landing_page OPA
OPA
OPA
OPA

openpolicyagent.org
● API Authorization
○ Performance: 1000+ rps
○ Policy: Authorize HTTP/GRPC APIs. Written by devs in YAML/GUI. Translated into Rego.
○ Decision: allow/deny
○ Integration: Go library, daemon GET /<path>
○ Policy management: Custom or k8s CRDs. Requests for postgres/S3 backends.
○ Mode: proactive
Istio Linkerd

openpolicyagent.org
Use Cases: Terraform Architecture
Terraform State
CICD Pipeline
OPA
OPA
Risk Management
● Compute risk of infra change
● Limit blast radius based on
seniority of author
● Automatic approvals and manual
approvals
Terraform change
Public Cloud
Public Cloud Resource Audit
● Find public cloud resources not
under control of Terraform
● Report violations of policy

openpolicyagent.org
Use Cases: Terraform: Risk Management Decision
Policy Query
POST opa:8181/v1/data/terraform/risk_score
{“input”: {
"aws_autoscaling_group.my_asg": {
"arn": "",
"availability_zones.#": "1",
"availability_zones.3205754986": "us-west-1a",
"default_cooldown": "",
"desired_capacity": "4",
"destroy": false,
"destroy_tainted": false,
"force_delete": "true",
"health_check_grace_period": "300",
"health_check_type": "ELB",
"metrics_granularity": "1Minute",
"min_size": "1",
"name": "my_asg",
},
"aws_instance.web": {
"ami": "ami-09b4b74c",
"associate_public_ip_address": "",
"availability_zone": "",
"destroy": false,
...
Policy Decision
200 OK
{
“result”: 15
}

openpolicyagent.org
Use Cases: Terraform
● Risk Management
○ Performance: 1 rps
○ Policy: compute risk score for proposed Terraform change. JSON-pointer + iteration
○ Decision: number
○ Integration: ?
○ Policy management: ?
○ Mode: proactive
● Public Cloud Audit
○ Performance: run periodically
○ Policy: compare cloud resources to those managed by Terraform. JSON-pointer + iteration
○ Decision: set of resources
○ Integration: ?
○ Policy management: 1
○ Mode: audit
Hashicorp
Terraform

openpolicyagent.org
New Use Cases
● Ratelimiting
○ Early days of this use case
○ Performance: 1000+ rps
○ Policy: choose ratelimit. Written using GUI/YAML. YAML treated as data in policy.
○ Decision: number
○ Integration: ?
○ Policy management: Custom
○ Mode: proactive
● Data protection: Minio, Kafka, OpenSDSS
○ Performance: 1000 rps
○ Policy: AWS IAM policies translated to Rego
○ Decision: allow/deny
○ Integration: GET /path
○ Policy management: Custom minio federation service
○ Mode: proactive

openpolicyagent.org
Lessons Learned
● Iteration/JSON-pointer/modules common expressiveness requirements
○ Policy about images in a k8s pod or about a Terraform plan needs iteration and JSON-pointer
● Data as a first-class citizen helps with writing policy
○ YAML/GUI data becomes the user-facing policy language; admin encodes semantics in Logic
● Policy decisions can be more complex than allow/deny
○ Assuming the technology supports it
● Always at the mercy of the system you are integrating with
○ Users willing to modify their application are great! So are systems that support plugins.
● Valuable to operate without a hard dependency on storage
○ Every system already has some storage system; they rarely want another etcd to manage
○ But everyone asks about storage options
● The higher the performance requirement, the simpler the policy
○ The tradeoff is unavoidable, but it’s possible to lessen the impact.

openpolicyagent.org
Thank You!
github.com/open-policy-agent/opa
slack.openpolicyagent.org

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references
container = spec.containers[index]

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references
# expressions
container.securityContext.privileged = true

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references
# expressions
# functions
}

openpolicyagent.org
kind: Pod
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
nodeName: minikube
status:
containerStatuses:
- name: nginx
ready: true
hostIP: 192.168.99.100
phase: Running
podIP: 172.17.0.4
# references
# expressions
# functions
}
# rules
deny {
review.user = “bob”
review.operation = “CREATE”
review.namespace = “production”
is_privileged(spec.containers[_])
}

openpolicyagent.org
Integration
OR
HTTP API
Service (Go)
OPA
Service
OPA
HTTP
List all policies GET v1/policies
Insert, modify, and delete policies GET/PUT/DELETE v1/policies/<path>
Insert and modify raw data PUT/PATCH v1/data/<path>
Get policy decision GET/POST v1/data/<path>
Evaluate ad-hoc policy queries GET v1/query?q=<query>
?metrics
?watch
?explain
include metrics (ex: latency)
stream updates
explain why result is true

openpolicyagent.org
Example Policies
● Images may only be pulled from internal registry
● Only scanned images may be deployed in namespaces
A, B, and C
● QA team must sign-off on image before deployed to
production
● Stateful deployments must use ‘recreate’ update
strategy
● Developers must not modify selectors or labels referred
to by selectors after creation
● Containers must have CPU and memory resource
requests and limits set
● Containers cannot run with privileged security context
● Services in namespace X should have AWS SSL
annotation added
● Product teams may only expose services with hostname
from whitelist...
apiserver
admission control
OPA

openpolicyagent.org
Performance: Microservice APIs
Benchmarks run on every release, e.g. https://gist.github.com/tsandall/97729bef8ee804a75b9e20e81508782d#file-_results_
+----------------+--------------------+--------------+------------+--------------+-----------+-----------------+
| Percentile (%) | Serialization (µs) | Request (µs) | Parse (µs) | Compile (µs) | Eval (µs) | Processing (µs) |
+----------------+--------------------+--------------+------------+--------------+-----------+-----------------+
| 50 | 2 | 358 | 11 | 43 | 180 | 14 |
| 75 | 3 | 389 | 12 | 45 | 186 | 16 |
| 90 | 3 | 437 | 13 | 49 | 200 | 19 |
| 95 | 4 | 495 | 15 | 56 | 234 | 23 |
| 99 | 8 | 1886 | 29 | 87 | 736 | 35 |
| 99.9 | 23 | 2583 | 221 | 205 | 2215 | 69 |
| 99.99 | 72 | 3357 | 1920 | 264 | 2617 | 161 |
+----------------+--------------------+--------------+------------+--------------+-----------+-----------------+
HTTP Latency
allow {
input.method = "GET"
input.path = ["finance", "salary", account_id]
input.user_id = account_id
}
1000 rules with 10 hits
Note: v0.6 will reduce eval
latency by 2-orders of
magnitude

openpolicyagent.org
Integration: Python
def check_request(request):
body = { # prepare body for OPA query by...
"input": { # supplying input data containing...
"auth_user": request.token.username, # authenticated username/identity (e.g., bob)
"path": request.path.split("/"), # HTTP URL path (e.g., /widgets/12345)
"method": request.method, # HTTP method (e.g., POST, GET, DELETE, etc.)
}
}
# query authorization policy in OPA for ‘allow’ decision
response = requests.post(“http://opa:8181/v1/data/acmecorp/api/authz/allow”, data=body)
# check OPA response for ‘allow’ decision
if not response.json()[“result”][“allow”]:
raise Exception(“request rejected by administrative policy”)

openpolicyagent.org
Related Projects
Project Open Source Decentralized Non-boolean
Decisions
Context-aware
OPA Apache 2 Yes Yes Yes
Firebase Rules No Yes No Yes
HashiCorp Sentinel No Yes No Yes (*)
OpenStack Congress Apache 2 No Yes Yes (**)
Ladon (XACML) Apache 2 Yes No Yes (*)

openpolicyagent.org
Project Status
Features as of v0.6.0
● Language
● Query evaluation
● Partial evaluation
● Tracing & Explanations
● REPL
● HTTP APIs
● Pluggable storage
● Triggers
● Transactions
● Test Framework
● HTTPS
● Authentication (Bearer Tokens)
● Authorization
Roadmap
● Features
○ Partial Eval
○ CEL compatibility
○ Performance profiles
○ Local disk storage
○ Etcd storage
○ Query profiling
○ Query benchmarking
○ Failure explanations
○ Golang plugin built-ins
○ JavaScript built-ins
○ Remediation engine
○ Remote REPL
● Integrations
○ OpenShift
○ DCOS
○ Docker ecosystem
○ Standard library
Community
● slack.openpolicyagent.org
● blog.openpolicyagent.org
● github.com/open-policy-agent/opa
● github.com/open-policy-agent/library

OPA APIs and Use Case Survey

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to OPA APIs and Use Case Survey

Similar to OPA APIs and Use Case Survey (20)

Recently uploaded

Recently uploaded (20)

OPA APIs and Use Case Survey