How Netflix Is Solving Authorization Across Their Cloud [I]

on YouTube ↗36m

" summary

Netflix describes a cloud authorization system that runs an OPA policy engine in-process or as a sidecar, with an aggregator/distributor pipeline that pushes delta updates to hot agents, supports REST, gRPC, Kafka and SSH resources, and enforces policies in sub-millisecond latency (benchmarks around 10–20 µs and app tests under 0.2 ms). A UI generates Rego policies and stores unit tests with each policy so changes run tests before deployment, and the system is live across hundreds of teams.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 0:39Background - Definitions
3. 2:08Background - Netflix Architecture
4. 5:10AuthZ Problem
5. 6:58Design Considerations
6. 11:39High-level Architecture
7. 15:07AuthZ Agent Internals
8. 15:43Example Setup
9. 17:56Open Policy Agent (OPA)
10. 20:07Example Policy (in English)
11. 20:26OPA: Rules
12. 22:00OPA: Context-aware
13. 23:15OPA: Composable
14. 23:58OPA: Resource-agnostic
15. 24:22OPA: Performance
16. 26:25Capturing Intent
17. 30:50Summary
18. 32:26Take Away
19. 34:21Questions?

" related talks

• 35mOPA: The Cloud Native Policy EngineTorin Sandall · KubeCon + CloudNativeCon Europe 2018
• 38mOPA for the cloud nativesPhilipp Krenn · DevOpsDays Warsaw 2022
• 30mArmy of Proxies! How Netflix scales identity based zero trust...Grant Callaghan · BSidesSF 2024
• 42mDesign Patterns for OPA and Cloud Native AuthorizationTim Hinrichs · CloudOpen @ Open Source Summit North America 2022
• 28mHow Netflix Makes gRPC Easy to Serve, Consume, and Operate - Benjamin Fedorka, NetflixBenjamin Fedorka · gRPConf 2023
• 38mSecuring Distributed Cache: Achieving Secure-by-Default with Key Challenges &...Akashdeep Goel, Sriram Rangarajan, Samuel Fu · SREcon25 Americas
• 36mOPA for the cloud nativesPhilipp Krenn · Voxxed Days Ticino 2023
• 33mIntro: Open Policy AgentTorin Sandall · KubeCon + CloudNativeCon China 2018