Kubernetes Admission Control

Kubernetes automates deployment, scaling, and management of containerized applications. OPA provides fine-grained, context-aware authorization for which application component configuration.

Inventors

• Styra
• Microsoft
• Google

Code

• https://github.com/open-policy-agent/kube-mgmt
• https://github.com/open-policy-agent/gatekeeper

Tutorials

• https://www.openpolicyagent.org/docs/kubernetes-admission-control.html
• https://katacoda.com/austinheiman/scenarios/open-policy-agent-gatekeeper

Videos

• Securing Kubernetes With Admission Controllers - Kubecon Seattle 2018
  • Dave Strebel - Microsoft


• Using OPA for Admission Control in Production - Kubecon Seattle 2018
  • Zach Abrahamson - Capital One
  • Todd Ekenstam - Intuit


• Liz Rice Keynote - Kubecon Seattle 2018
  • Liz Rice - AquaSecurity


• Intro to Open Policy Agent Gatekeeper - Kubecon Barcelona 2019
  • Rita Zhang - Microsoft
  • Max Smythe - Google


• Policy Enabled Kubernetes and CICD - OPA Summit at Kubecon San Diego 2019
  • Jimmy Ray - CapitalOne


• TripAdvisor: Building a Testing Framework for Integrating OPA into K8s - OPA Summit at Kubecon San Diego 2019
  • Luke Massa - TripAdvisor


• Enforcing automatic mTLS with Linkerd and OPA Gatekeeper - Kubecon San Diego 2019
  • Ivan Sim - Buoyant
  • Rita Zhang - Microsoft


• Enforcing Service Mesh Structure using OPA Gatekeeper - Kubecon San Diego 2019
  • Sandeep Parikh - Google


• TGIK: Exploring the Open Policy Agent -
  • Joe Beda - VMware

Blogs

• https://medium.com/@sbueringer/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://medium.com/@jimmy.ray/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
• https://blog.openpolicyagent.org/securing-the-kubernetes-api-with-open-policy-agent-ce93af0552c3
• https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
• https://blog.openshift.com/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent/

Terraform Policy

Terraform lets you describe the infrastructure you want and automatically creates, deletes, and modifies your existing infrastructure to match. OPA makes it possible to write policies that test the changes Terraform is about to make before it makes them.

Inventors

• Fugue
• Accurics
• Checkmarx
• Medallia
• Styra
• Docker
• Snyk

Code

• https://github.com/instrumenta/conftest
• https://github.com/fugue/regula
• https://github.com/accurics/terrascan
• https://github.com/Checkmarx/kics
• https://github.com/open-policy-agent/library/tree/master/terraform
• https://github.com/accurics/terrascan/tree/master/pkg/policies/opa/rego
• https://github.com/Checkmarx/kics/tree/master/assets/queries/terraform

Tutorials

• https://www.openpolicyagent.org/docs/terraform.html
• https://github.com/instrumenta/conftest/blob/master/README.md

Blogs

• https://blog.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa

Styra Declarative Authorization Service

Styra DAS provides a single pane of glass for authorization and policy across the cloud-native ecosystem of software systems. Beyond a simple control plane, Styra DAS pushes OPA’s potential, providing powerful impact analysis, policy authoring, and decision logging.

Inventors

• Styra

Code

• https://github.com/StyraInc/das-opa-samples
• https://github.com/StyraInc/example-policy-management
• https://github.com/StyraInc/entitlements-samples

Tutorials

• https://docs.styra.com/getting-started
• https://docs.styra.com/tutorials/kubernetes/introduction
• https://docs.styra.com/tutorials/envoy/introduction
• https://docs.styra.com/tutorials/ssh/introduction
• https://docs.styra.com/tutorials/terraform/introduction
• https://docs.styra.com/tutorials/entitlements/introduction
• https://academy.styra.com/courses/opa-rego

Videos

• Securing Microservices-Based Apps with Dynamic Traffic Authz - online
  • Kurt Roekle - Styra


• Policy Management Across the Cloud-Native Stack: Styra DAS for Terraform - online
  • Kurt Roekle - Styra

Blogs

• https://blog.styra.com/blog/six-of-my-favorite-styra-declarative-authorization-service-das-features
• https://blog.styra.com/blog/styra-declarative-authorization-service-expands-service-mesh-use-case
• https://blog.styra.com/blog/opa-styra-terraform-protect-your-cloud-investment
• https://www.styra.com/blog/how-to-write-your-first-rules-in-rego-the-policy-language-for-opa

Container Network Authorization with Envoy

Envoy is a networking abstraction for cloud-native applications. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-istio-plugin
• https://github.com/tsandall/minimal-opa-envoy-example

Tutorials

• https://github.com/tsandall/minimal-opa-envoy-example/blob/master/README.md
• https://www.openpolicyagent.org/docs/latest/envoy-introduction/

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest


• Deploying Open Policy Agent at Atlassian - OPA Summit at Kubecon San Diego 2019
  • Chris Stivers - Atlassian
  • Nicholas Higgins - Atlassian


• How Yelp Moved Security From the App to the Mesh with Envoy and OPA - Kubecon San Diego 2019
  • Daniel Popescu - Yelp
  • Ben Plotnick - Yelp

Blogs

• https://blog.openpolicyagent.org/envoy-external-authorization-with-opa-578213ed567c

Authorization for Java Spring Security

Spring Security provides a framework for securing Java applications. These integrations provide simple implementations for Spring Security that use OPA for making API authorization decisions. They provide support for both traditional Spring Security (MVC), as well as an implementation for Spring Reactive (Web Flux).

Inventors

• Styra
• build.security
• Bisnode
• AlertAVert.com

Code

• https://github.com/open-policy-agent/contrib/tree/master/spring_authz
• https://github.com/Bisnode/opa-spring-security
• https://github.com/build-security/opa-java-spring-client
• https://github.com/massenz/jwt-opa
• https://github.com/eugenp/tutorials/tree/master/spring-security-modules/spring-security-opa

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/spring_authz/README.md
• https://github.com/massenz/jwt-opa#web-server-demo-app
• https://www.baeldung.com/spring-security-authorization-opa

Kafka Topic Authorization

Apache Kafka is a high-performance distributed streaming platform deployed by thousands of companies. OPA provides fine-grained, context-aware access control of which users can read/write which Kafka topics to enforce important requirements around confidentiality and integrity.

Inventors

• TicketMaster
• Styra

Code

• https://github.com/StyraInc/opa-kafka-plugin
• https://github.com/llofberg/kafka-authorizer-opa
• https://github.com/opencredo/opa-single-message-transformer

Tutorials

• https://www.openpolicyagent.org/docs/latest/kafka-authorization/

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest

Blogs

• https://opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent/

Aserto

Aserto is a cloud-native authorization service that makes it easy to add permissions and RBAC to your SaaS applications and APIs. Aserto is based on the Open Policy Agent.

Inventors

• Aserto

Code

• https://github.com/aserto-dev
• https://github.com/opcr-io

Tutorials

• https://docs.aserto.com/docs

Videos

• https://www.youtube.com/watch?v=RJkgmdjJn_w

Blogs

• https://www.aserto.com/blog/how-do-aserto-rego-policies-work
• https://www.aserto.com/blog/testing-rego-policies
• https://www.aserto.com/blog/aserto-on-aserto-an-opa-authorization-policy-for-aserto-tenants
• https://www.aserto.com/blog/rego-getting-started

Container Network Authorization with Istio (at the Edge)

Istio is a networking abstraction for cloud-native applications that uses Envoy at the edge. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-istio-plugin
• https://github.com/tsandall/minimal-opa-envoy-example
• https://github.com/open-policy-agent/opa-envoy-spire-ext-authz

Tutorials

• https://github.com/open-policy-agent/opa-istio-plugin/blob/master/README.md

Blogs

• https://blog.openpolicyagent.org/envoy-external-authorization-with-opa-578213ed567c

Custom Application Authorization

Application require authorization decisions made at the API gateway, frontend, backend, and database. OPA helps developers decouple authorization logic from application code, define a custom authorization model that enables end-users to control tenant permissions, and enforce that policy across the different components of the application (gateway, frontend, backend, database).

Tutorials

• https://github.com/chef/automate/tree/master/components/authz-service#authz-with-opa

Videos

• OPA in Practice: From Angular to OPA in Chef Automate - OPA Summit at Kubecon San Diego 2019
  • Michael Sorens - Chef

Blogs

• https://blog.verygoodsecurity.com/posts/building-a-fine-grained-permission-system-in-a-distributed-environment/
• https://choria.io/blog/post/2020/02/14/rego_policies_opa/

Enterprise OPA

An enterprise-grade drop-in replacement for the Open Policy Agent with improved performance and out of the box enterprise integrations

Inventors

• Styra

Code

• https://github.com/StyraInc/enterprise-opa

Tutorials

• https://docs.styra.com/enterprise-opa/tutorials
• https://docs.styra.com/enterprise-opa/tutorials/performance-testing
• https://docs.styra.com/enterprise-opa/tutorials/grpc-basic-tutorial
• https://docs.styra.com/enterprise-opa/tutorials/grpc-go-tutorial
• https://docs.styra.com/enterprise-opa/tutorials/lia
• https://docs.styra.com/enterprise-opa/tutorials/decision-logs/
• https://docs.styra.com/enterprise-opa/tutorials/kafka
• https://docs.styra.com/enterprise-opa/tutorials/abac-with-sql

Videos

• Start Loving Your Data-heavy Authorization - online
  • Torin Sandall - Styra
  • Chris Hendrix - Styra

Blogs

• https://www.styra.com/blog/introducing-styra-load-enterprise-opa-distribution-for-data-heavy-authorization/

Fairwinds Insights Configuration Validation Software

Automate, monitor and enforce OPA policies with visibility across multiple clusters and multiple teams. It ensures the same policies are applied across all your clusters and gives some flexibility if you want certain policies to apply to only certain workloads. Run the same policies in CI/CD, Admission Control, and In-cluster scanning to apply policy consistently throughout the development and deployment process.

Inventors

• Fairwinds

Tutorials

• https://insights.docs.fairwinds.com/features/policy/
• https://insights.docs.fairwinds.com/reports/opa/
• https://insights.docs.fairwinds.com/features/admission-controller/
• https://insights.docs.fairwinds.com/features/continuous-integration/

Videos

• https://youtu.be/kmvPYjx1bpU


• https://youtu.be/gxE_Tkj6d40

Blogs

• https://www.fairwinds.com/blog/managing-opa-policies-with-fairwinds-insights
• https://www.fairwinds.com/blog/manage-open-policy-agent-opa-consistently
• https://www.fairwinds.com/blog/kubernetes-multi-cluster-visibility-why-how-to-get-it
• https://www.fairwinds.com/blog/what-is-kubernetes-policy-as-code
• https://www.fairwinds.com/blog/why-kubernetes-policy-enforcement
• https://www.fairwinds.com/blog/an-interview-with-flatfile-on-why-fairwinds-insights-kubernetes-configuration-validation

Permit.io

Permit.io empowers developers to bake in permissions and access-control into any product in minutes and takes away the pain of constantly rebuilding them. Permit is based on OPA.

Inventors

• Permit.io

Code

• https://github.com/permitio

Tutorials

• https://docs.permit.io/

Videos

• https://docs.permit.io/tutorials/onboarding_demo

Blogs

• https://www.permit.io/blog/introduction-to-opa
• https://www.permit.io/blog/implement-abac-using-opa
• https://www.permit.io/blog/implement-rbac-using-opa

HTTP API Authorization in PHP

These integrations demonstrate using OPA to perform API authorization in PSR-15 and Symfony compliant frameworks.

Inventors

• build.security

Code

• https://github.com/segrax/opa-php-examples
• https://github.com/segrax/openpolicyagent
• https://github.com/build-security/opa-symfony-middleware

Tutorials

• https://coil.com/p/segra/OPA-for-API-Authorization-with-Slim-PHP/H-7YsQL2m

Rönd

Rönd is a lightweight container that distributes security policy enforcement throughout your application.

Inventors

• Mia-Platform

Code

• https://github.com/rond-authz/rond

Tutorials

• https://github.com/rond-authz/example

Videos

• Rönd - The Open Source K8s sidecar that defines security policies over your APIs -
  • Federico Maggi - Mia-Platform

Blogs

• https://blog.mia-platform.eu/en/announcing-rond-new-open-source-security-enforcement-over-your-apis
• https://blog.mia-platform.eu/en/how-why-adopted-role-based-access-control-rbac

Strimzi (Apache Kafka on Kubernetes)

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes in various deployment configurations. Strimzi ships with the OPA authorizer plugin right out of the box, and supports OPA as an option for Kafka authorization.

Inventors

• RedHat

Code

• https://github.com/strimzi/strimzi-kafka-operator
• https://github.com/scholzj/demo-opa-kafka-authorization
• https://github.com/StyraInc/opa-kafka-plugin

Blogs

• https://strimzi.io/blog/2020/08/05/using-open-policy-agent-with-strimzi-and-apache-kafka/
• https://strimzi.io/blog/2020/09/01/enforce-custom-resource-policies-with-opa-gatekeeper/

Topaz

Topaz is an open source authorization service providing fine grained, real-time, policy based access control for applications and APIs. Topaz uses OPA as its decision engine, and includes an embedded database that stores subjects, relations, and objects, inspired by the Google Zanzibar data model. Topaz can be deployed as a sidecar or microservice in your cloud.

Inventors

• Aserto

Code

• https://github.com/aserto-dev/topaz

Tutorials

• https://www.topaz.sh
• https://github.com/aserto-dev/topaz#quickstart

Blogs

• https://www.aserto.com/blog/topaz-oss-cloud-native-authorization-combines-opa-zanzibar

Authorization Integration with Apache APISIX

Apache APISIX provides a plugin for delegating fine-grained authorization decisions to OPA.

Inventors

• Apache APISIX

Code

• https://github.com/apache/apisix

Blogs

• https://apisix.apache.org/blog/2021/12/24/open-policy-agent
• https://medium.com/@ApacheAPISIX/apache-apisix-integrates-with-open-policy-agent-to-enrich-its-ecosystem-15569fe3ab9c

AWS CloudFormation Hook

AWS CloudFormation Hook that uses OPA to make policy decisions on infrastructure provisioned via AWS CloudFormation

Inventors

• Styra

Code

• https://github.com/StyraInc/opa-aws-cloudformation-hook

Tutorials

• https://www.openpolicyagent.org/docs/latest/aws-cloudformation-hooks/

Blogs

• https://blog.styra.com/blog/the-opa-aws-cloudformation-hook

Ceph Object Storage Authorization

Ceph is a highly scalable distributed storage solution that uniquely delivers object, block, and file storage in one unified system. OPA provides fine-grained, context-aware authorization of the information stored within Ceph.

Inventors

• Styra
• RedHat

Tutorials

• https://docs.ceph.com/docs/master/radosgw/opa/
• https://www.katacoda.com/styra/scenarios/opa-ceph

Videos

• https://www.youtube.com/watch?v=9m4FymEvOqM&feature=share

i2scim.io SCIM Restful User/Group Provisioning API

i2scim.io is an open source, Apache 2 Licensed, implementation of SCIM (System for Cross-domain Identity Management RFC7643/7644) for use cloud-native kubernetes platforms. i2scim supports externalized access control decisions through OPA. SCIM is a RESTful HTTP API that can be used to provide a standardized way to provision accounts from Azure, Okta, PingIdentity and other providers and tools. SCIM can also be used as a backing identity store for OAuth and other authentication services.

Inventors

• Independent Identity

Code

• https://github.com/i2-open/i2scim
• https://i2scim.io

Tutorials

• https://i2scim.io/OPA_AccessControl.html

Kubernetes Authorization

Kubernetes Authorization is a pluggable mechanism that lets administrators control which users can run which APIs and is often handled by builtin RBAC. OPA's policy language is more flexible than the RBAC, for example, writing policy using a prohibited list of APIs instead of the usual RBAC style of listing the permitted APIs.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/main/k8s_authorization

Blogs

• https://blog.styra.com/blog/kubernetes-authorization-webhook
• https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b

Kubescape Kubernetes security posture scanner

This integration uses OPA for defining security controls over Kubernetes clusters. Kubescape is a simple extensible tool finding security problems in your environment. OPA enables Kubescape to implement and extend very fast to answer new problems.

Inventors

• ARMO

Code

• https://github.com/kubescape/kubescape
• https://github.com/kubescape/regolibrary

Tutorials

• https://hub.armosec.io/docs

OPAL (Open Policy Administration Layer)

OPAL is an administration layer for Open Policy Agent (OPA), detecting changes in realtime to both policy and policy data and pushing live updates to your agents. OPAL brings open-policy up to the speed needed by live applications. As your application state changes (whether it's via your APIs, DBs, git, S3 or 3rd-party SaaS services), OPAL will make sure your services are always in sync with the authorization data and policy they need (and only those they need).

Inventors

• Permit.io

Code

• https://github.com/permitio/opal

Tutorials

• https://github.com/permitio/opal/tree/master/documentation/docs/tutorials

Videos

• https://www.youtube.com/watch?v=K1Zm2FPfrh8

Open Policy Registry

The Open Policy Registry project provides a docker workflow for OPA policies. The policy CLI can be used to build, tag, sign, push, and pull OPA policies as OCIv2 container images, in conjunction with any container registry. The Open Policy Registry (OPCR) is a reference implementation of a policy registry, built and hosted on GCP.

Inventors

• Aserto

Code

• https://github.com/opcr-io/policy

Tutorials

• https://www.openpolicyregistry.io/docs/tutorial

Blogs

• https://www.openpolicyregistry.io/blog/docker-workflow-for-opa

Pulumi

Build infrastructure as code in familiar languages. CrossGuard is Pulumi's policy as code offering, providing OPA as one of the options to use for defining policy.

Inventors

• Pulumi

Code

• https://github.com/pulumi/pulumi-policy-opa

Videos

• Testing Configuration with Open Policy Agent - Cloud Engineering Summit 2020
  • Gareth Rushgrove - Snyk

Blogs

• https://www.pulumi.com/blog/opa-support-for-crossguard/

Regal - The Rego Linter

Regal is a linter for Rego, with the goal of making your Rego magnificent! Regal can: * Identify common mistakes, bugs and inefficiencies in Rego policies, and suggest better approaches * Provide advice on best practices, coding style, and tooling * Allow users, teams and organizations to enforce custom rules on their policy code

Inventors

• Styra

Code

• https://github.com/StyraInc/regal

Videos

• https://www.youtube.com/live/Xx8npd2TQJ0?feature=share&t=2567

Blogs

• https://www.styra.com/blog/guarding-the-guardrails-introducing-regal-the-rego-linter/

Scalr - Policy enforcement for Terraform

Scalr allows teams to easily collaborate on Terraform through its pipeline that runs all Terraform operations, policy checks, and stores state. Scalr uses OPA to check the auto-generated Terraform JSON plan to ensure that it meets your organization standards prior to an apply.

Inventors

• Scalr

Code

• https://github.com/Scalr/sample-tf-opa-policies

Tutorials

• https://iacp.docs.scalr.com/en/latest/working-with-iacp/opa.html#creating-the-opa-policy

Blogs

• https://www.scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac/

Spacelift

Spacelift is a sophisticated CI/CD platform for Infrastructure as Code including Terraform, Pulumi, CloudFormation, Kubernetes, and Ansible. Spacelift utilizes Open Policy Agent to support a variety of policy types within the platform and Policy as Code for secure and compliance Infrastructure as Code.

Inventors

• Spacelift

Code

• https://github.com/spacelift-io/spacelift-policies-example-library

Tutorials

• https://docs.spacelift.io/concepts/policy

Blogs

• https://spacelift.io/blog/what-is-open-policy-agent-and-how-it-works

SPIRE

SPIRE is a production-ready implementation of the SPIFFE APIs that performs node and workload attestation in order to securely issue SPIFFE Verifiable Identity Documents (SVIDs) to workloads, and verify the SVIDs of other workloads, based on a predefined set of conditions.

Code

• https://github.com/spiffe/spire/blob/v1.0.2/doc/authorization_policy_engine.md

Tutorials

• https://spiffe.io/docs/latest/microservices/envoy-opa/readme/
• https://spiffe.io/docs/latest/microservices/envoy-jwt-opa/readme/

Blogs

• https://blog.styra.com/blog/zero-trust-with-envoy-spire-and-open-policy-agent-opa

Torque

Torque by Quali is a cloud-based platform that provides infrastructure automation and orchestration solutions for digital transformation and DevOps initiatives. Troque utilizes Open Policy Agent (OPA) to enforce policy-as-code, enabling users to define and automate their own security, compliance, and governance policies across their infrastructure.

Inventors

• Quali

Code

• https://github.com/QualiTorque/opa

Tutorials

• https://docs.qtorque.io/governance/policies

Blogs

• https://www.quali.com/blog/enforcing-open-policy-agent-guardrails-across-your-cloud-configurations/

walt.id

Verifying W3C Verifiable Credentials for building SSI (Self-Sovereign Identity) use cases.

Inventors

• walt.id
• Blockchain Lab:UM
• Netis

Code

• https://github.com/walt-id/waltid-ssikit

Tutorials

• https://docs.walt.id/v/ssikit/ssi-kit/open-policy-agent
• https://docs.walt.id/v/ssikit/concepts/verification-policies/dynamic-policies

Videos

• Verifying W3C Verifiable Credentials with the SSI Kit using OPA (Open Policy Agent) -
  • Severin Stampler - walt.id

Boomerang Bosun Policy Gating

Boomerang Bosun is a policy-based gating system that combines Policy Templates with Rules and data to validate Gates.

Inventors

• IBM
• Boomerang

Code

• https://www.useboomerang.io/
• https://github.com/boomerang-io

Custom Bottle Application Authorization

This integration demonstrates using Open Policy Agent to perform API authorization for a Python application backed by Bottle. Bottle is a fast, simple and lightweight WSGI micro web-framework for Python.

Code

• https://github.com/dolevf/bottle-acl-openpolicyagent

Blogs

• https://blog.lethalbit.com/open-policy-agent-for-bottle-web-framework/

Kubernetes Admission Control using Vulnerability Scanning

Admission control policies in Kubernetes can be augmented with vulnerability scanning results to make more informed decisions. This integration demonstrates how to integrate Clair with OPA and run it as an admission controller.

Code

• https://github.com/open-policy-agent/contrib/tree/master/image_enforcer

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/image_enforcer/README.md

Cloudflare Worker Enforcement of OPA Policies Using WASM

Cloudflare Workers are a serverless platform that supports WASM. This integration uses OPA's WASM compiler to generate code enforced at the edge of Cloudflare's network.

Code

• https://github.com/open-policy-agent/contrib/tree/master/wasm/cloudflare-worker

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/wasm/cloudflare-worker/README.md

Conftest -- Configuration checking

Conftest is a utility built on top of OPA to help you write tests against structured configuration data.

Code

• https://github.com/instrumenta/conftest

Videos

• Applying Policy Throughout the Application Lifecycle with Open Policy Agent - Kubecon San Diego 2019
  • Gareth Rushgrove - Snyk

Container Signing, Verification and Storage in an OCI registry

Cosign is a tool for container image signing and verifying maintained under the Project Sigstore in collaboration with the Linux Foundation. Among other features, Cosign supports KMS signing, built-in binary transparency, and timestamping service with Rekor and Kubernetes policy enforcement.

Inventors

• Sigstore

Code

• https://docs.sigstore.dev/cosign/attestation#validate-in-toto-attestations
• https://github.com/sigstore/cosign-gatekeeper-provider

Dapr

Middleware to apply Open Policy Agent policies on incoming requests

Code

• https://github.com/dapr/dapr

Tutorials

• https://docs.dapr.io/reference/components-reference/supported-middleware/middleware-opa/

HTTP API Authorization in Dart

This integration demonstrates how to leverage OPA to perform basic HTTP API authorization in a simple Dart microservice. OPA makes it possible to provide fine-grained context-aware authorization for each REST endpoint and access method.

Inventors

• Adaptant

Code

• https://github.com/adaptant-labs/opa-api-authz-dart

Tutorials

• https://github.com/adaptant-labs/opa-api-authz-dart/README.md

Docker controls via OPA Policies

Docker's out of the box authorization model is all or nothing. This integration demonstrates how to use OPA's context-aware policies to exert fine-grained control over Docker.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-docker-authz

Tutorials

• https://www.openpolicyagent.org/docs/latest/docker-authorization/

Elasticsearch Data Filtering

Elasticsearch is a distributed, open source search and analytics engine. This OPA integration lets an elasticsearch client construct queries so that the data returned by elasticsearch obeys OPA-defined policies.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/data_filter_elasticsearch

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/data_filter_elasticsearch/README.md

fig

Beautiful shell autocompletion for OPA and many other commands, for Mac OS

Inventors

• fig

Code

• https://github.com/open-policy-agent/contrib/tree/main/opa_fig_autocomplete
• https://github.com/withfig/autocomplete/blob/master/src/opa.ts

Flask-OPA

Simple to use Flask extension that lets you secure your projects with OPA. It allows HTTP API Authorization and Policy Enforcement Point (AOP using decorators on methods).

Code

• https://github.com/EliuX/flask-opa

Blogs

• https://github.com/EliuX/flask-opa/tree/master/examples

GCP audit with Forseti

Google cloud provides a plethora of software as a service. Forseti, built using OPA, lets you run policy checks against the software resources on Google cloud and remediate violations.

Inventors

• Google

Code

• https://forsetisecurity.org

Videos

• Repeatable GCP Environments at Scale with Cloud Build Infra-as-Code Pipelines - Cloud Next 2019
  • Morgante Pell - Google
  • Andrew Phillips - Google

Gloo API Gateway

Gloo is an open-source Kubernetes-native ingress controller, and next-generation API gateway. OPA can be used to implement authorization policies for those APIs.

Blogs

• https://medium.com/solo-io/5-min-with-gloo-api-gateway-configuration-with-open-policy-agent-53da276a6534
• https://docs.solo.io/gloo/latest/security/auth/opa/

Google Calendar

Using the Google Calendar API with OPA for calendar powered policy decisions

Inventors

• Styra

Code

• https://github.com/anderseknert/opa-google-calendar

Blogs

• https://blog.styra.com/blog/the-power-of-data-calendar-based-policy-enforcement

Google Kubernetes Engine (GKE)

OPA related tools and policy libraries for Kubernetes in the Google Cloud Platform

Inventors

• Google

Code

• https://github.com/google/gke-policy-automation

Tutorials

• https://github.com/google/gke-policy-automation/tree/main/gke-policies

Gradle Build Plugin

Build plugin adding various tasks to support using OPA as part of Gradle builds

Inventors

• Bisnode

Code

• https://github.com/Bisnode/opa-gradle-plugin
• https://plugins.gradle.org/plugin/com.bisnode.opa

GraphQL

GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data.

Code

• https://github.com/StyraInc/graphql-apollo-example

Tutorials

• https://www.openpolicyagent.org/docs/graphql-api-authorization/

IPTables

IPTables is a useful tool available to Linux kernel for filtering network packets. OPA makes it possible to manage IPTables rules using context-aware policy.

Inventors

• Google Summer of Code
• Cisco
• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/opa-iptables

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/opa-iptables/docs/tutorial.md

Container Network Authorization with Istio (as part of Mixer)

Istio is a networking abstraction for cloud-native applications. In this Istio integration OPA hooks into the centralized Mixer component of Istio, to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Google

Code

• https://github.com/istio/istio/tree/master/mixer/adapter/opa

Tutorials

• https://istio.io/docs/reference/config/policy-and-telemetry/adapters/opa/

API Gateway Authorization with Kong

Kong is a microservice API Gateway. OPA provides fine-grained, context-aware control over the requests that Kong receives.

Inventors

• TravelNest
• World Anti-Doping Agency

Code

• https://github.com/TravelNest/kong-authorization-opa
• https://github.com/open-policy-agent/contrib/tree/master/kong_api_authz

Secure Kubernetes using eBPF & Open Policy Agent

Ensure runtime security in any linux machine by combining Extended Berkeley Packet Filter(eBPF) and Open Policy Agent.

Code

• https://github.com/kubeshield/bpf-opa-demo

Blogs

• https://blog.byte.builders/post/bpf-opa/

SSH and Sudo Authorization with Linux

Host-level access controls are an important part of every organization's security strategy. OPA provides fine-grained, context-aware controls for SSH and sudo using Linux-PAM.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/pam_opa

Tutorials

• https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html

Magda

Magda is a federated, Kubernetes-based, open-source data catalog system. Working as Magda's central authorisation policy engine, OPA helps not only the API endpoint authorisation. Magda also uses its partial evaluation feature to translate datasets authorisation decisions to other database-specific DSLs (e.g. SQL or Elasticsearch DSL) and use them for dataset authorisation enforcement in different databases.

Code

• https://github.com/magda-io/magda

Blogs

• https://github.com/magda-io/magda/blob/master/docs/docs/architecture/Guide%20to%20Magda%20Internals.md#authorization-authz

OAuth2

Integrating OAuth2 with Open Policy Agent

Tutorials

• https://www.openpolicyagent.org/docs/latest/oauth-oidc/

Blogs

• https://blog.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent

OpenID Connect (OIDC)

Integrating OpenID Connect (OIDC) with Open Policy Agent

Tutorials

• https://www.openpolicyagent.org/docs/latest/oauth-oidc/

Blogs

• https://blog.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent

Open Service Mesh (OSM)

Open Service Mesh is a lightweight and extensible cloud native service mesh.

Code

• https://github.com/openservicemesh/osm/blob/main/docs/example/manifests/opa/deploy-opa-envoy.yaml

Tutorials

• https://release-v0-11.docs.openservicemesh.io/docs/guides/integrations/external_auth_opa/#osm-with-opa-plugin-external-authorization-walkthrough

OpenFaaS Serverless Function Authorization

OpenFaaS is a serverless function framework that runs on Docker Swarm and Kubernetes. OPA makes it possible to provide fine-grained context-aware authorization on a per-function basis.

Inventors

• Adaptant

Code

• https://github.com/adaptant-labs/openfaas-function-auth-opa

Tutorials

• https://github.com/adaptant-labs/openfaas-function-auth-opa/blob/master/README.md

OPToggles (Open Policy Toggles)

OPToggles uses OPA and OPAL to sync open-policy to your frontend with the help of feature flag solutions. OPToggles creates user-targeted feature flags based on the policy rules you defined in OPA and keeps the users updated in real-time with OPAL's real-time policy and policy-data change detection. OPToggles already supports launchdarkly.com and a generic REST API.

Inventors

• Permit.io

Code

• https://github.com/permitio/OPToggles

Tutorials

• https://optoggles.opal.ac/tutorials/demo

Pomerium Access Proxy

Pomerium is an identity-aware proxy that enables secure access to internal applications. OPA implements authorization under the hood.

Code

• https://github.com/pomerium/pomerium

Blogs

• https://www.pomerium.io/posts/2020/04/16/release-0-7/

Pre-commit hooks

Pre-commit git hooks for OPA and Rego development

Inventors

• Independent developer

Code

• https://github.com/anderseknert/pre-commit-opa

Blogs

• https://www.eknert.com/tech/2020/08/31/pre-commit-hooks-for-opa

Rekor transparency log monitoring and alerting

Rekor Sidekick monitors a Rekor signature transparency log and forwards events of interest where ever you like. Alert policies written in Rego determine if an event is of interest.

Inventors

• Sigstore

Code

• https://github.com/nsmith5/rekor-sidekick

Videos

• https://www.youtube.com/watch?v=lHSLPIo1pz8

Reposaur

Audit, verify and report on development platforms (GitHub and others) easily with pre-defined and/or custom policies.

Inventors

• Reposaur

Code

• https://github.com/reposaur/reposaur

Tutorials

• https://docs.reposaur.com/guides/writing-your-first-policy

Sansshell

A non-interactive daemon for host management

Inventors

• Snowflake

Code

• https://github.com/Snowflake-Labs/sansshell

Blogs

• https://www.snowflake.com/blog/sansshell-local-host-agent/

Spinnaker Pipeline Policy Enforcment

Spinnaker is a Continuous Delivery and Deployment tool started by Netflix. OPA lets you configure policies that dictate what kinds of Spinnaker pipelines developers can create.

Inventors

• Armory

Tutorials

• https://docs.armory.io/spinnaker/policy_engine/

Blogs

• https://blog.armory.io/deployment-policies-with-spinnaker/

SQL Database Data Filtering

This integration enables the client of a SQL database to enhance a SQL query so that the results obey an OPA-defined policy.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/data_filter_example

Blogs

• https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4

Terraform Cloud

Policies are rules that Terraform Cloud enforces on runs. You use the Rego policy language to write policies for the Open Policy Agent (OPA) framework.

Inventors

• HashiCorp

Tutorials

• https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/opa
• https://developer.hashicorp.com/terraform/tutorials/cloud/drift-and-opa
• https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/opa/vcs

Videos

• Terraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies - HashiConf Europe 2022
  • Rita Sokolova - HashiCorp
  • Cole Morrison - HashiCorp

Self-hosted Alternative to OPA Playground

Alfred introduces a local graphical user interface to interact with Open Policy Agent and acts as an alternative to OPA's playground, allowing the user to keep information related to policy testing locally.

Code

• https://github.com/dolevf/Open-Policy-Agent-Alfred

Alluxio

Alluxio is an open source data orchestration technology for analytics and AI for the cloud. Alluxio can integrate with OPA and delegate all permission checks to OPA.

Inventors

• Alluxio

Tutorials

• https://docs.alluxio.io/ee/user/2.10.0/en/security/OpenPolicyAgent-Integration.html

ANTLR Grammar

ANTLR4 grammar for Rego.

Inventors

• Independent developer

Code

• https://github.com/antlr/grammars-v4

ASP.NET Core

Use ASP.NET Core to create web apps and services that are fast, secure, cross-platform, and cloud-based. OPA can be used to implement authorization policies for APIs used in the ASP.NET Core framework.

Inventors

• build.security

Code

• https://github.com/build-security/OPA-AspDotNetCore-Middleware

Awesome OPA List

A curated list of awesome OPA related tools, frameworks and articles.

Inventors

• Styra

Code

• https://github.com/StyraInc/awesome-opa

AWS API Gateway

The AWS API Gateway controls API traffic for your application running on AWS. OPA can be configured as an external authorizer for that Gateway to implement authorization policies on APIs.

Code

• https://github.com/zotoio/sls-lambda-opa

CircleCI

Use config policy management to create organization-level policies to impose rules and scopes around which configuration elements are required, allowed, not allowed etc.

Inventors

• CircleCI

Tutorials

• https://circleci.com/docs/config-policy-management-overview/

App authorization for Clojure

Authorization middleware for Ring based apps and other utilities for working with OPA in Clojure.

Inventors

• Styra

Code

• https://github.com/anderseknert/clj-opa

CoreDNS Authorization

CoreDNS is a cloud-native DNS server written in Go. OPA can be used as a plugin to filter queries and responses.

Inventors

• InfoBlox

Code

• https://github.com/coredns/policy

Library-based Microservice Authorization

Microservice authorization can be enforced through a network proxy like Envoy/Istio/Linkerd/... or can be enforced by modifying the microservice code to use a common library. In both cases OPA makes the authorization decision that the network proxy or the library enforce.

Videos

• How Netflix is Solving Authorization Across Their Cloud - Kubecon Austin 2017
  • Manish Mehta - Netflix
  • Torin Sandall - Styra

Easegress

Easegress is a Cloud Native API orchestration system. OPA can be configured as a filter(plugin) to implement authorization policies for the APIs.

Inventors

• MegaEase

Code

• https://github.com/megaease/easegress

Emissary-Ingress

Emissary-Ingress is an open-source Kubernetes-native API Gateway, Layer 7 load balancer and Kubernetes Ingress built on Envoy Proxy. OPA can be integrated with Emissary as an external authorization service to enforce authorization policies over APIs.

Blogs

• https://www.infracloud.io/blogs/emissary-ingress-opa-integration/

fiber

Fiber is an Express inspired web framework built on top of Fasthttp, the fastest HTTP engine for Go. Designed to ease things up for fast development with zero memory allocation and performance in mind. With Open Policy Agent integration, you can run your Rego policies as part of the request lifecycle in the middleware.

Code

• https://github.com/gofiber/contrib/tree/main/opafiber

Gluu Gateway Authorization

Gluu Gateway provides API authentication and authorization for websites built on Kong. Gluu provides an OPA plugin to handle API authorization.

Code

• https://github.com/GluuFederation/gluu-gateway

Custom Application with Field-level Authorization in Graphene GraphQL

This integration demonstrates using Open Policy Agent to perform field-level Authorization with GraphQL for a custom Python application backed by Graphene.

Code

• https://github.com/dolevf/graphql-open-policy-agent

Authorization for Java

Integrations for interacting with OPA from Java

Inventors

• Bisnode

Code

• https://github.com/Bisnode/opa-java-client

Jenkins Job Trigger Policy Enforcement

Jenkins automates software development processes. OPA lets you control which people and which machines can run which Jenkins jobs.

Inventors

• Pinterest

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest

Kubernetes Provisioning

Kubernetes automates deployment, scaling, and management of containerized applications. OPA decides which resources need to be created on k8s in response to a namespace being created.

Inventors

• Goldman Sachs

Videos

• Kubernetes Policy Enforcement Using OPA at Goldman Sachs - Kubecon San Diego 2019
  • Miguel Uzcategui - Goldman Sachs
  • Tim Hinrichs - Styra

Minio API Authorization

Minio is an open source, on-premise object database compatible with the Amazon S3 API. This integration lets OPA enforce policies on Minio's API.

Inventors

• Minio
• Styra

Tutorials

• https://github.com/minio/minio/blob/master/docs/iam/opa.md

Nginx

OPA Authorization for Nginx

Code

• https://github.com/summerwind/opa-nginx-rbac

NodeJS express

Express is a minimal and flexible Node.js web application framework that provides a robust set of features for web and mobile applications. OPA can be used to implement authorization policies for APIs used in the express framework.

Inventors

• build.security

Code

• https://github.com/build-security/opa-express-middleware

Automatically document Rego policies

Sphinx extension that automatically documents Open Policy Agent Rego policies using meta properties.

Inventors

• Zenity

Code

• https://github.com/zenitysec/sphinx-rego

Kubernetes Sysdig Image Scanner Admission Controller

Sysdig’s OPA Image Scanner combines Sysdig Secure image scanner with OPA policy-based rego language to evaluate the scan results and the admission context, providing great flexibility on the admission decision.

Inventors

• Sysdig

Code

• https://github.com/sysdiglabs/opa-image-scanner

Traefik API Gateway

The Traefik API Gateway is open-source software that controls API traffic into your application. OPA can be configured as a plugin to implement authorization policies for those APIs.

Blogs

• https://engineering.etermax.com/api-authorization-with-kubernetes-traefik-and-open-policy-agent-23647fc384a1

ccbr

CCBR is a policy management system project. It uses the policy language Rego to implement the CIS benchmark test of cloud native kubernetes. In addition, it integrates gatekeeper, manages its constraint templates, constraints and policies, and supports policy deployment and audit inspection.

Inventors

• WirelessSecurityLab

Code

• https://github.com/wirelesssecuritylab/ccbr