Customizing OPA for a "Perfect Fit" Authorization Sidecar
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 17:55· Intrado Virtual Event Platform,·
summary
Shows how to build a custom OPA binary in Go that actually ships and runs: a custom.fetch.jwks Rego builtin that uses the builtin context cache to fetch and cache remote keys, a Kafka decision log plugin that synchronously produces JSON decision events to a topic, and a gRPC authorizer API plugin that evaluates policies via manager.store and calls the decision logger. Code, Dockerfile and demos run end to end; logs appear in Kafka and gRPC checks return results.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:22Open Policy Agent
- 0:48Sidecar Authz
- 1:19OPA is Perfect
- 4:31Extending OPA - RTFM Edition
- 4:54Extending OPA - The Fear
- 18:17OPA Plugins 101
- 22:32Custom Decision Logger Plugin
- 27:51Custom API Frontend - Solution
- 31:18Custom API Frontend - Problem
related talks
45mOPA Deep Dive
40mOPA Introduction & Community Update
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
42mDesign Patterns for OPA and Cloud Native Authorization
34mFine-grained Authorization in a Containerized World
32mOPA: So What Does the Policy Do?
37mMake your security policy auditable
33mOpen Policy Agent Deep Dive