Policy-based control for cloud native environments

Flexible, fine-grained control foradministrators across the stack

Stop using a different policy language, policy model, and policyAPI for every product and service you use. Use OPA for a unifiedtoolset and framework for policy across the cloud native stack.

Whether for one service or for all your services, use OPA todecouple policy from the service's code so you can release,analyze, and review policies (which security and compliance teamslove) without sacrificing availability or performance.

Created By

OPA is now maintained by Styra and a large community of contributors

Declarative Policy

Context-aware, Expressive, Fast, Portable

Ensure all images comefrom a trusted registry Stop ingresses from usingthe same host name

{    "apiVersion": "admission.k8s.io/v1",    "kind": "AdmissionReview",    "request": {        "kind": {            "group": "",            "kind": "Pod",            "version": "v1"        },        "object": {            "metadata": {                "name": "myapp"            },            "spec": {                "containers": [                    {                        "image": "nginx",                        "name": "nginx-frontend"                    },                    {                        "image": "mysql",                        "name": "mysql-backend"                    }                ]            }        }    }}

package kubernetes.admissiondeny contains sprintf("image '%s' comes from untrusted registry", [container.image]) if {input.request.kind.kind == "Pod"some container in input.request.object.spec.containersnot startswith(container.image, "example.com/")}

{  "deny": [    "image 'mysql' comes from untrusted registry",    "image 'nginx' comes from untrusted registry"  ]}

{    "apiVersion": "admission.k8s.io/v1beta1",    "kind": "AdmissionReview",    "request": {        "kind": {            "group": "extensions",            "kind": "Ingress",            "version": "v1beta1"        },        "object": {            "metadata": {                "name": "prod",                "namespace": "bar"            },            "spec": {                "rules": [                    {                        "host": "initech.com",                        "http": {                            "paths": [                                {                                    "backend": {                                        "serviceName": "banking",                                        "servicePort": 443                                    },                                    "path": "/finance"                                }                            ]                        }                    }                ]            }        }    }}

package kubernetes.admission# Reject any ingress with the same host as an existing ingressdeny contains msg if {input.request.kind.kind == "Ingress"# iterate over all hosts in input Ingresssome rule in input.request.object.spec.rulesnewhost := rule.host# iterate over all existing ingresses and all hosts for each ingresssome namespace, namesome oldrule in data.kubernetes.ingresses[namespace][name].spec.rulesoldhost := oldrule.host# reject if the oldhost and the newhost are the samenewhost == oldhostmsg := sprintf("ingress host conflicts with ingress %s/%s", [namespace, name])}

{  "deny": []}

Allow everyone to run GET on/petsAllow frontend service torun GET on/pets/owners

{    "attributes": {        "destination": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 8000                        },                        "address": "172.17.0.8"                    }                }            }        },        "request": {            "http": {                "headers": {                    ":authority": "example-app",                    ":method": "GET",                    ":path": "/pets",                    "user-agent": "Wget",                    "x-forwarded-proto": "http",                    "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"                },                "host": "example-app",                "id": "8910035251488566126",                "method": "GET",                "path": "/pets",                "protocol": "HTTP/1.1"            }        },        "source": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 54292                        },                        "address": "172.17.0.6"                    }                }            }        }    },    "parsed_path": [        "pets"    ]}

package envoy.authz# allow all GET requests to /petsdefault allow := falseallow if {input.attributes.request.http.method == "GET"input.attributes.request.http.path == "/pets"}

{  "allow": true}

{    "attributes": {        "destination": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 8000                        },                        "address": "172.17.0.8"                    }                }            }        },        "request": {            "http": {                "headers": {                    ":authority": "example-app",                    ":method": "GET",                    ":path": "/pets/owners",                    "user-agent": "Wget",                    "x-forwarded-client-cert": "By=spiffe://domain.test/db-server;Hash=331f2f4eb2a1729fa4e0f46c8c663786098151ae571fed7b66680e970f6a0f94;URI=spiffe://domain.test/frontend",                    "x-forwarded-proto": "http",                    "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"                },                "host": "example-app",                "id": "8910035251488566126",                "method": "GET",                "path": "/pets/owners",                "protocol": "HTTP/1.1"            }        },        "source": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 54292                        },                        "address": "172.17.0.6"                    }                }            }        }    },    "parsed_path": [        "pets",        "owners"    ]}

package envoy.authz# allow only the frontend service to GET /pets/ownersdefault allow := falseallow if {http_request.path == "/pets/owners"http_request.method == "GET"source_spiffe_id == "spiffe://domain.test/frontend"}source_spiffe_id := client_id if {[_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")[_, client_id] := split(uri_type_san, "=")}http_request := input.attributes.request.http

{  "allow": true,  "http_request": {    "headers": {      ":authority": "example-app",      ":method": "GET",      ":path": "/pets/owners",      "user-agent": "Wget",      "x-forwarded-client-cert": "By=spiffe://domain.test/db-server;Hash=331f2f4eb2a1729fa4e0f46c8c663786098151ae571fed7b66680e970f6a0f94;URI=spiffe://domain.test/frontend",      "x-forwarded-proto": "http",      "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"    },    "host": "example-app",    "id": "8910035251488566126",    "method": "GET",    "path": "/pets/owners",    "protocol": "HTTP/1.1"  },  "source_spiffe_id": "spiffe://domain.test/frontend"}

Only the pet's owner canupdate that pet's information Only employees,authenticated with a JWT, can see already adoptedpets

{    "method": "PUT",    "owner": "bob@example.com",    "path": [        "pets",        "pet113-987"    ],    "user": "alice@example.com"}

package application.authz# Only owner can update the pet's information# Ownership information is provided as part of OPA's inputdefault allow := falseallow if {input.method == "PUT"some petidinput.path = ["pets", petid]input.user == input.owner}

{  "allow": false}

{    "pet_list": [        {            "breed": "St. Bernard",            "name": "Cujo",            "up_for_adoption": false        },        {            "breed": "Collie",            "name": "Lassie",            "up_for_adoption": true        }    ],    "token": "eyJ1IjoiSFMyNTYiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWxpY2UiLCJlbXBsb3llZSI6dHJ1ZSwibmFtZSI6IkFsaWNlIFNtaXRoIn0.vMBYEW8VK9XM7yPkKTu1C3Gy1tOq1A0d4-xYMkkRpEc"}

package application.authz# Everyone can see pets up for adoptionallowed_pets contains pet if {some pet in input.pet_listpet.up_for_adoption}# Employees can see all pets.allowed_pets contains pet if {[_, payload, _] := io.jwt.decode(input.token)payload.employeesome pet in input.pet_list}

{  "allowed_pets": [    {      "breed": "Collie",      "name": "Lassie",      "up_for_adoption": true    },    {      "breed": "St. Bernard",      "name": "Cujo",      "up_for_adoption": false    }  ]}

Declarative Policy

Context-aware, Expressive, Fast, Portable

Kubernetes

Envoy

Application

Kubernetes

Ensure all images come from atrusted registry Stopingresses from using the same host name

{    "apiVersion": "admission.k8s.io/v1beta1",    "kind": "AdmissionReview",    "request": {        "kind": {            "group": "",            "kind": "Pod",            "version": "v1"        },        "object": {            "metadata": {                "name": "myapp"            },            "spec": {                "containers": [                    {                        "image": "nginx",                        "name": "nginx-frontend"                    },                    {                        "image": "mysql",                        "name": "mysql-backend"                    }                ]            }        }    }}

package kubernetes.admissiondeny contains sprintf("image '%s' comes from untrusted registry", [container.image]) if {input.request.kind.kind == "Pod"some container in input.request.object.spec.containersnot startswith(container.image, "example.com/")}

{  "deny": [    "image 'mysql' comes from untrusted registry",    "image 'nginx' comes from untrusted registry"  ]}

{    "apiVersion": "admission.k8s.io/v1beta1",    "kind": "AdmissionReview",    "request": {        "kind": {            "group": "extensions",            "kind": "Ingress",            "version": "v1beta1"        },        "object": {            "metadata": {                "name": "prod",                "namespace": "bar"            },            "spec": {                "rules": [                    {                        "host": "initech.com",                        "http": {                            "paths": [                                {                                    "backend": {                                        "serviceName": "banking",                                        "servicePort": 443                                    },                                    "path": "/finance"                                }                            ]                        }                    }                ]            }        }    }}

package kubernetes.admission# Reject any ingress with the same host as an existing ingressdeny contains msg if {input.request.kind.kind == "Ingress"# iterate over all hosts in input Ingresssome rule in input.request.object.spec.rulesnewhost := rule.host# iterate over all existing ingresses and all hosts for each ingresssome namespace, namesome oldrule in data.kubernetes.ingresses[namespace][name].spec.rulesoldhost := oldrule.host# reject if the oldhost and the newhost are the samenewhost == oldhostmsg := sprintf("ingress host conflicts with ingress %s/%s", [namespace, name])}

{  "deny": []}

Envoy

Allow everyone to run GET on/petsAllowfrontend service to run GET on/pets/owners

{    "attributes": {        "destination": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 8000                        },                        "address": "172.17.0.8"                    }                }            }        },        "request": {            "http": {                "headers": {                    ":authority": "example-app",                    ":method": "GET",                    ":path": "/pets",                    "user-agent": "Wget",                    "x-forwarded-proto": "http",                    "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"                },                "host": "example-app",                "id": "8910035251488566126",                "method": "GET",                "path": "/pets",                "protocol": "HTTP/1.1"            }        },        "source": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 54292                        },                        "address": "172.17.0.6"                    }                }            }        }    },    "parsed_path": [        "pets"    ]}

package envoy.authz# allow all GET requests to /petsdefault allow := falseallow if {input.attributes.request.http.method == "GET"input.attributes.request.http.path == "/pets"}

{  "allow": true}

{    "attributes": {        "destination": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 8000                        },                        "address": "172.17.0.8"                    }                }            }        },        "request": {            "http": {                "headers": {                    ":authority": "example-app",                    ":method": "GET",                    ":path": "/pets/owners",                    "user-agent": "Wget",                    "x-forwarded-client-cert": "By=spiffe://domain.test/db-server;Hash=331f2f4eb2a1729fa4e0f46c8c663786098151ae571fed7b66680e970f6a0f94;URI=spiffe://domain.test/frontend",                    "x-forwarded-proto": "http",                    "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"                },                "host": "example-app",                "id": "8910035251488566126",                "method": "GET",                "path": "/pets/owners",                "protocol": "HTTP/1.1"            }        },        "source": {            "address": {                "Address": {                    "SocketAddress": {                        "PortSpecifier": {                            "PortValue": 54292                        },                        "address": "172.17.0.6"                    }                }            }        }    },    "parsed_path": [        "pets",        "owners"    ]}

package envoy.authzimport input.attributes.request.http as http_request# allow only the frontend service to GET /pets/ownersdefault allow := falseallow if {http_request.path == "/pets/owners"http_request.method == "GET"source_spiffe_id == "spiffe://domain.test/frontend"}source_spiffe_id = client_id if {[_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")[_, client_id] := split(uri_type_san, "=")}

{  "allow": true,  "source_spiffe_id": "spiffe://domain.test/frontend"}

Application

Only the pet's owner can updatethat pet's information Onlyemployees, authenticated with a JWT, can see alreadyadopted pets

{    "method": "PUT",    "owner": "bob@example.com",    "path": [        "pets",        "pet113-987"    ],    "user": "alice@example.com"}

package application.authz# Only owner can update the pet's information# Ownership information is provided as part of OPA's inputdefault allow := falseallow if {input.method == "PUT"some petidinput.path = ["pets", petid]input.user == input.owner}

{  "allow": false}

{    "pet_list": [        {            "breed": "St. Bernard",            "name": "Cujo",            "up_for_adoption": false        },        {            "breed": "Collie",            "name": "Lassie",            "up_for_adoption": true        }    ],    "token": "eyJ1IjoiSFMyNTYiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWxpY2UiLCJlbXBsb3llZSI6dHJ1ZSwibmFtZSI6IkFsaWNlIFNtaXRoIn0.vMBYEW8VK9XM7yPkKTu1C3Gy1tOq1A0d4-xYMkkRpEc"}

package application.authz# Everyone can see pets up for adoptionallowed_pets contains pet if {some pet in input.pet_listpet.up_for_adoption}# Employees can see all pets.allowed_pets contains pet if {[_, payload, _] := io.jwt.decode(input.token)payload.employeesome pet in input.pet_list}

{  "allowed_pets": [    {      "breed": "Collie",      "name": "Lassie",      "up_for_adoption": true    },    {      "breed": "St. Bernard",      "name": "Cujo",      "up_for_adoption": false    }  ]}

Declarative. Express policy ina high-level,declarative language that promotes safe,performant, fine-grained controls. Use a languagepurpose-built for policy in a world where JSON ispervasive. Iterate, traverse hierarchies, and apply150+ built-ins like string manipulation and JWTdecoding to declare the policies you want enforced.

Context-aware. Leverageexternal information towrite the policies you really care about. Stopinventing roles that represent complex relationshipsthat years down the road no one will understand.Instead, write logic that adapts to the world aroundit and attach that logic to the systems that need it.

Learn More

Kubernetes Envoy Terraform Kafka SQL Linux

Architectural Flexibility

Balance integration, availability,consistency

Daemon

Service

Policy
(Rego)

Data
(JSON)

Deploy OPA as a separate process on the samehost as your service. Integrate OPA by changingyour service’s code, importing an OPA-enabledlibrary, or using a network proxy integrated with OPA.

Library

Service

Policy
(Rego)

Data
(JSON)

Embed OPA policies into your service. Integrate OPA as a Golibrarythat evaluates policy, or integrate a WebAssembly runtimeand use OPAto compile policy to WebAssembly instructions.

Learn More

Daemon Library

Tools for Policy Authoring

IDEs, Sharing, Profiling, Testing, Coverage

Rego Playground for Policy Sharing

VS Code for Policy Authoring

CLI and REPL for complete control

OPA embraces policy-as-code, complete with tools that help peopleuse and understand the policies they putinplace. Integrated development environments, testing, profiling,coverage, automated performance tuning, andhotreloading aren’t just things you need for programming--you need themfor policy too, and OPA delivers.

Learn More

VS Code Rego Playground General Tooling OPA GitHub

Open Policy Agent is a Cloud Native Computing FoundationGraduated project.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation,please see ourTrademark Usage page.

Movatterモバイル変換

Policy-based control for cloud native environments

Declarative Policy

Declarative Policy

Architectural Flexibility

Daemon

Service

Library

Service

Tools for Policy Authoring

Rego Playground for Policy Sharing

VS Code for Policy Authoring

CLI and REPL for complete control