Distributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy Agent
summary
Shows a working system that moves authorization out of service code into sidecars using Kubernetes + Istio + OPA, with Envoy calling OPA via Envoy external authorization and policies delivered as bundles. Authorization rules live as a git-backed service-rules CRD and OPA auto-updates bundles from cloud storage; tests on GCP show hundreds of rules evaluate in microseconds. The result is distributed, language-agnostic auth with cached user lookups and no central runtime bottleneck.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:52Agenda
- 1:09Background and Goals
- 8:34Challenges
- 11:30Goals
- 13:25Kubernetes
- 13:58Istio
- 18:19External Authorization in Envoy
- 19:57Open Policy Agent
- 22:59High Level Design
- 24:02External Authorization Filter
- 26:01What Is a Communities Operator
- 27:43Operator Pattern
- 30:52Upload a Compiled Policy to the Cluster
- 49:57Enable External Authorization and Void Filter
- 51:08Configuration
- 51:28Benchmark
- 53:12Summary
related talks
05mLightning Talk: How We Use Istio and OPA for Authorization
05mLightning Talk: How We Use Istio and OPA for Authorization
09mSecure UI + Microservices within Kubernetes using OPA Authorization
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
16mDistributed application level RBAC with OPA
38mPolicy as Code with Open Policy Agent
34mFine-grained Authorization in a Containerized World
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP