Beyond Entitlements for the Cloud Native
summary
Shows a concrete responsibility management design using Open Policy Agent (Rego) deployed as OPA sidecars to avoid a single-point federated RMS, with a policy bundle format (policy + role/user data + standard library) pulled by each service. Uses Spring Boot, HOCON for compact GET payloads, and Eclipse Collections for memory-efficient handling. Addresses hiccups: polling/restart pain when publishing policies and rogue-policy blast radius, so a policy administration service with activate-on-demand and an IDE Rego plugin for validation is built.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03Problem scenarios
- 9:04Responsibility management
- 17:50Technology choices
- 25:17Open Policy Agent
- 30:16Architecture attempts
- 37:16Distributed RMS
- 44:13OPA IntelliJ plugin
- 47:01Summary and links
related talks
56mCloud-native Policy Enforcement
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
16mDistributed application level RBAC with OPA
25mMake Your Security Policy Auditable
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
36mOpen Policy Agent: security for cloud natives and everyone else
32mOPA: So What Does the Policy Do?
42mDesign Patterns for OPA and Cloud Native Authorization