Open Policy Agent Deep Dive

The Open Policy Agent (OPA) is an open-source general-purpose policy engine hosted by the Cloud Native Computing Foundation (CNCF). At OPA’s core is a domain-agnostic declarative language that embodies policy as code. OPA helps you implement policy as code so that you can apply best practices like unit testing, dry runs, and code review to your policies.

0:00 Intro Of Speaker
1:39 What problem does OPA solves?
2:30 Challenges managing Policies in Complex Systems?
3:11 Goals Of OPA
3:57 What OPA provide to us?
6:39 Some words on OPA community
7:44 OPA production users
8:00 Kelsey thoughts on OPA
8:26 OPA decision model
11:18 OPA deployment
12:39 Policy Authoring & Rego
14:30 Policy Data
16:40 Demo Rego in action 🚀
20:36 Testing Policies in Rego
22:22 Formatting policies in Rego
23:00 Providing Input to policies
25:45 Testing Input policies
27:00 OPA eval and what's the limitations?

🚀 OPA's responsibility is to make a policy decision on its own and return that decision as a JSON object back to the caller. It's up to the caller to decide what to do with the OPA decision. Semantically, OPA only operates on the data passed to it (typically as JSON). So OPA doesn't require a deep knowledge about the environment itself. This makes OPA flexible and portable to many different use cases.
🚀 Rego is a high-level declarative language that's based on decades of research into policy systems. It embodies specific ideas that make it useful for these kinds of more modern cloud-native systems and is designed like an onion. There are core parts of the language that are extremely fast. As you need more expressiveness, you move up the performance curve.
🚀 OPA is most often used as an admission controller in Kubernetes. An admission controller is where all the semantic validation of Kubernetes resources occur before resources are persisted to etcd and controllers go off and start doing work.

Join Anders for a deep dive session that shows how to apply policy as code across microservices and Kubernetes, covering core language features like search, composition, and querying of complex document-oriented data. See how powerful declarative languages become with the right tooling.

About the Guest

🎓 Anders Eknert | Developer Advocate at Styra, Inc. 🎓

Have worked in various roles from systems developer to technical lead, team lead and developer advocate. With a background in both tech and business, I enjoy building bridges between people from all backgrounds. Technical experience across the full stack in a number of different languages, frameworks and data stores - the last years however have been quite heavy on JVM languages and tooling - Java, Kotlin, Clojure, Groovy and related technologies. From time to time scripting as well, using whatever seems like the best tool for the job including Python, Scheme and of course just regular shell scripts.


A curated list of OPA related tools, frameworks and articles.

⚒️ About the OPA.

Policy-based control for cloud native environments

Makers of OPA

👨‍🎓 About the Host 👨‍🎓

Join Cloud Native Islamabad community.

🧑‍🤝‍🧑 About the Community 🧑‍🤝‍🧑

Here's we host our Cloud Native Webinar's Thanks to CNCF:

#CloudNativeIslamabad #OpenPolicyAgent #StyraInc

[marekbarczyk]

The best OPA video I've found on YouTube. Thank you!

[HugoScavinoUSA]

Thank you for this. I learned more in this session especially on the REST and Kubectl integration. I will go to the styra academy to learn more.

[inbarraz]

The policy has a vulnerability :-) Saying "Starts with /public" will also allow paths like "/public123" and "/public_whatever". In the name of proper use-case handling, this should have been divided into two separate rules: (1) Path is EQUAL to "/public"; (2) Path STARTS WITH "/public/".

[saikatdutta]

Is there any utility for dubugging experience? Json Path is one way where we can explore large complex json file and find out the desired elements. Hope something like this for rego will come up.

[IONYVDFC]

As I see policies as permissions that are granted based on a ruleset. How do I define a role that implements a set of multiple permissions in one go ? FYI OPA is new to me.