Distributed application level RBAC with OPA
summary
Decisions: a Kubernetes sidecar enforces role based access control using OpenPolicy Agent with Rego and the Go SDK, not a centralized gateway, so authorization runs per service and scales with pods. Policies perform grant/deny checks, prequery filtering to restrict DB reads, and response rewriting to drop fields. The team maps API actions to role bindings, compiles policies for speed, and reports only a small latency addition while keeping language agnosticism and no single point of failure.
AI-written summary · about
chapters (8)
- 0:00Welcome
- 1:28Moving to distributed RBAC
- 3:13RBAC implementation challenges
- 6:00Authorization sidecar design
- 8:25Choosing Open Policy Agent
- 10:08OPA sidecar integration
- 12:57Access control policy examples
- 14:41Final thoughts
related talks
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
34mFine-grained Authorization in a Containerized World
14mA Policy-as-Code Approach to RBAC Authorization
32mImplementing Authorization
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
20mDeep Dive: Kubernetes Policy WG
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent