AWS API Gateway

The AWS API Gateway controls API traffic for your application running on AWS. OPA can be configured as an external authorizer for that Gateway to implement authorization policies on APIs.

Code

• https://github.com/zotoio/sls-lambda-opa

Boomerang Bosun Policy Gating

Boomerang Bosun is a policy-based gating system that combines Policy Templates with Rules and data to validate Gates.

Inventors

• IBM
• Boomerang

Code

• https://www.useboomerang.io/
• https://github.com/boomerang-io

Ceph Object Storage Authorization

Ceph is a highly scalable distributed storage solution that uniquely delivers object, block, and file storage in one unified system. OPA provides fine-grained, context-aware authorization of the information stored within Ceph.

Inventors

• Styra
• RedHat

Tutorials

• https://docs.ceph.com/docs/master/radosgw/opa/
• https://www.katacoda.com/styra/scenarios/opa-ceph

Videos

• https://www.youtube.com/watch?v=9m4FymEvOqM&feature=share

Kubernetes Admission Control using Vulnerability Scanning

Admission control policies in Kubernetes can be augmented with vulnerability scanning results to make more informed decisions. This integration demonstrates how to integrate Clair with OPA and run it as an admission controller.

Code

• https://github.com/open-policy-agent/contrib/tree/master/image_enforcer

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/image_enforcer/README.md

Cloudflare Worker Enforcement of OPA Policies Using WASM

Cloudflare Workers are a serverless platform that supports WASM. This integration uses OPA's WASM compiler to generate code enforced at the edge of Cloudflare's network.

Code

• https://github.com/open-policy-agent/contrib/tree/master/wasm/cloudflare-worker

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/wasm/cloudflare-worker/README.md

Conftest -- Configuration checking

Conftest is a utility built on top of OPA to help you write tests against structured configuration data.

Code

• https://github.com/instrumenta/conftest

Videos

• Applying Policy Throughout the Application Lifecycle with Open Policy Agent - Kubecon San Diego 2019
  • Gareth Rushgrove - Snyk

Custom Application Authorization

Application require authorization decisions made at the API gateway, frontend, backend, and database. OPA helps developers decouple authorization logic from application code, define a custom authorization model that enables end-users to control tenant permissions, and enforce that policy across the different components of the application (gateway, frontend, backend, database).

Tutorials

• https://github.com/chef/automate/tree/master/components/authz-service#authz-with-opa

Videos

• OPA in Practice: From Angular to OPA in Chef Automate - OPA Summit at Kubecon San Diego 2019
  • Michael Sorens - Chef

Blogs

• https://blog.verygoodsecurity.com/posts/building-a-fine-grained-permission-system-in-a-distributed-environment/
• https://choria.io/blog/post/2020/02/14/rego_policies_opa/

Library-based Microservice Authorization

Microservice authorization can be enforced through a network proxy like Envoy/Istio/Linkerd/... or can be enforced by modifying the microservice code to use a common library. In both cases OPA makes the authorization decision that the network proxy or the library enforce.

Videos

• How Netflix is Solving Authorization Across Their Cloud - Kubecon Austin 2017
  • Manish Mehta - Netflix
  • Torin Sandall - Styra

HTTP API Authorization in Dart

This integration demonstrates how to leverage OPA to perform basic HTTP API authorization in a simple Dart microservice. OPA makes it possible to provide fine-grained context-aware authorization for each REST endpoint and access method.

Inventors

• Adaptant

Code

• https://github.com/adaptant-labs/opa-api-authz-dart

Tutorials

• https://github.com/adaptant-labs/opa-api-authz-dart/README.md

Docker controls via OPA Policies

Docker's out of the box authorization model is all or nothing. This integration demonstrates how to use OPA's context-aware policies to exert fine-grained control over Docker.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-docker-authz

Tutorials

• https://www.openpolicyagent.org/docs/latest/docker-authorization/

Elasticsearch Data Filtering

Elasticsearch is a distributed, open source search and analytics engine. This OPA integration lets an elasticsearch client construct queries so that the data returned by elasticsearch obeys OPA-defined policies.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/data_filter_elasticsearch

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/data_filter_elasticsearch/README.md

Container Network Authorization with Envoy

Envoy is a networking abstraction for cloud-native applications. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-istio-plugin
• https://github.com/tsandall/minimal-opa-envoy-example

Tutorials

• https://github.com/tsandall/minimal-opa-envoy-example/blob/master/README.md
• https://www.openpolicyagent.org/docs/latest/envoy-authorization/

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest


• Deploying Open Policy Agent at Atlassian - OPA Summit at Kubecon San Diego 2019
  • Chris Stivers - Atlassian
  • Nicholas Higgins - Atlassian


• How Yelp Moved Security From the App to the Mesh with Envoy and OPA - Kubecon San Diego 2019
  • Daniel Popescu - Yelp
  • Ben Plotnick - Yelp

Blogs

• https://blog.openpolicyagent.org/envoy-external-authorization-with-opa-578213ed567c

GCP audit with Forseti

Google cloud provides a plethora of software as a service. Forseti, built using OPA, lets you run policy checks against the software resources on Google cloud and remediate violations.

Inventors

• Google

Code

• https://forsetisecurity.org

Videos

• Repeatable GCP Environments at Scale with Cloud Build Infra-as-Code Pipelines - Cloud Next 2019
  • Morgante Pell - Google
  • Andrew Phillips - Google

Gloo API Gateway

Gloo is an open-source Kubernetes-native ingress controller, and next-generation API gateway. OPA can be used to implement authorization policies for those APIs.

Blogs

• https://medium.com/solo-io/5-min-with-gloo-api-gateway-configuration-with-open-policy-agent-53da276a6534
• https://docs.solo.io/gloo/latest/security/auth/opa/

Gradle Build Plugin

Build plugin adding various tasks to support using OPA as part of Gradle builds

Inventors

• Bisnode

Code

• https://github.com/Bisnode/opa-gradle-plugin
• https://plugins.gradle.org/plugin/com.bisnode.opa

IPTables

IPTables is a useful tool available to Linux kernel for filtering network packets. OPA makes it possible to manage IPTables rules using context-aware policy.

Inventors

• Urvil Patel - Google Summer of Code
• Cisco
• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/opa-iptables

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/opa-iptables/docs/tutorial.md

Container Network Authorization with Istio (at the Edge)

Istio is a networking abstraction for cloud-native applications that uses Envoy at the edge. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/opa-istio-plugin
• https://github.com/tsandall/minimal-opa-envoy-example
• https://github.com/open-policy-agent/opa-envoy-spire-ext-authz

Tutorials

• https://github.com/open-policy-agent/opa-istio-plugin/blob/master/README.md

Blogs

• https://blog.openpolicyagent.org/envoy-external-authorization-with-opa-578213ed567c

Container Network Authorization with Istio (as part of Mixer)

Istio is a networking abstraction for cloud-native applications. In this Istio integration OPA hooks into the centralized Mixer component of Istio, to provide fine-grained, context-aware authorization for network or HTTP requests.

Inventors

• Google

Code

• https://github.com/istio/istio/tree/master/mixer/adapter/opa

Tutorials

• https://istio.io/docs/reference/config/policy-and-telemetry/adapters/opa/

Jenkins Job Trigger Policy Enforcement

Jenkins automates software development processes. OPA lets you control which people and which machines can run which Jenkins jobs.

Inventors

• Pinterest

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest

Kafka Topic Authorization

Apache Kafka is a high-performance distributed streaming platform deployed by thousands of companies. OPA provides fine-grained, context-aware access control of which users can read/write which Kafka topics to enforce important requirements around confidentiality and integrity.

Inventors

• TicketMaster
• Styra
• Bisnode

Code

• https://github.com/llofberg/kafka-authorizer-opa
• https://github.com/open-policy-agent/contrib/tree/master/kafka_authorizer
• https://github.com/Bisnode/opa-kafka-plugin

Tutorials

• https://www.openpolicyagent.org/docs/kafka-authorization.html

Videos

• OPA at Scale: How Pinterest Manages Policy Distribution - OPA Summit at Kubecon San Diego 2019
  • Will Fu - Pinterest
  • Jeremy Krach - Pinterest

API Gateway Authorization with Kong

Kong is a microservice API Gateway. OPA provides fine-grained, context-aware control over the requests that Kong receives.

Inventors

• TravelNest
• World Anti-Doping Agency

Code

• https://github.com/TravelNest/kong-authorization-opa
• https://github.com/open-policy-agent/contrib/tree/master/kong_api_authz

Kubernetes Authorization

Kubernetes Authorization is a pluggable mechanism that lets administrators control which users can run which APIs and is often handled by builtin RBAC. OPA's policy language is more flexible than the RBAC, for example, writing policy using a prohibited list of APIs instead of the usual RBAC style of listing the permitted APIs.

Blogs

• https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b

Kubernetes Provisioning

Kubernetes automates deployment, scaling, and management of containerized applications. OPA decides which resources need to be created on k8s in response to a namespace being created.

Inventors

• Goldman Sachs

Videos

• Kubernetes Policy Enforcement Using OPA at Goldman Sachs - Kubecon San Diego 2019
  • Miguel Uzcategui - Goldman Sachs
  • Tim Hinrichs - Styra

Kubernetes Admission Control

Kubernetes automates deployment, scaling, and management of containerized applications. OPA provides fine-grained, context-aware authorization for which application component configuration.

Inventors

• Styra
• Microsoft
• Google

Code

• https://github.com/open-policy-agent/kube-mgmt
• https://github.com/open-policy-agent/gatekeeper

Tutorials

• https://www.openpolicyagent.org/docs/kubernetes-admission-control.html
• https://katacoda.com/austinheiman/scenarios/open-policy-agent-gatekeeper

Videos

• Securing Kubernetes With Admission Controllers - Kubecon Seattle 2018
  • Dave Strebel - Microsoft


• Using OPA for Admission Control in Production - Kubecon Seattle 2018
  • Zach Abrahamson - Capital One
  • Todd Ekenstam - Intuit


• Liz Rice Keynote - Kubecon Seattle 2018
  • Liz Rice - AquaSecurity


• Intro to Open Policy Agent Gatekeeper - Kubecon Barcelona 2019
  • Rita Zhang - Microsoft
  • Max Smythe - Google


• Policy Enabled Kubernetes and CICD - OPA Summit at Kubecon San Diego 2019
  • Jimmy Ray - CapitalOne


• TripAdvisor: Building a Testing Framework for Integrating OPA into K8s - OPA Summit at Kubecon San Diego 2019
  • Luke Massa - TripAdvisor


• Enforcing automatic mTLS with Linkerd and OPA Gatekeeper - Kubecon San Diego 2019
  • Ivan Sim - Buoyant
  • Rita Zhang - Microsoft


• Enforcing Service Mesh Structure using OPA Gatekeeper - Kubecon San Diego 2019
  • Sandeep Parikh - Google


• TGIK: Exploring the Open Policy Agent -
  • Joe Beda - VMware

Blogs

• https://medium.com/@sbueringer/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://medium.com/@jimmy.ray/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
• https://blog.openpolicyagent.org/securing-the-kubernetes-api-with-open-policy-agent-ce93af0552c3
• https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
• https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
• https://blog.openshift.com/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent/

Secure Kubernetes using eBPF & Open Policy Agent

Ensure runtime security in any linux machine by combining Extended Berkeley Packet Filter(eBPF) and Open Policy Agent.

Code

• https://github.com/kubeshield/bpf-opa-demo

Blogs

• https://blog.byte.builders/post/bpf-opa/

SSH and Sudo Authorization with Linux

Host-level access controls are an important part of every organization's security strategy. OPA provides fine-grained, context-aware controls for SSH and sudo using Linux-PAM.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/pam_opa

Tutorials

• https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html

Minio API Authorization

Minio is an open source, on-premise object database compatible with the Amazon S3 API. This integration lets OPA enforce policies on Minio's API.

Inventors

• Minio
• Styra

Tutorials

• https://github.com/minio/minio/blob/master/docs/sts/opa.md

OpenFaaS Serverless Function Authorization

OpenFaaS is a serverless function framework that runs on Docker Swarm and Kubernetes. OPA makes it possible to provide fine-grained context-aware authorization on a per-function basis.

Inventors

• Adaptant

Code

• https://github.com/adaptant-labs/openfaas-function-auth-opa

Tutorials

• https://github.com/adaptant-labs/openfaas-function-auth-opa/blob/master/README.md

HTTP API Authorization in PHP

This integration demonstrates using OPA to perform API authorization in a PSR-15 compliant framework.

Code

• https://github.com/segrax/opa-php-examples
• https://github.com/segrax/openpolicyagent

Tutorials

• https://coil.com/p/segra/OPA-for-API-Authorization-with-Slim-PHP/H-7YsQL2m

Spinnaker Pipeline Policy Enforcment

Spinnaker is a Continuous Delivery and Deployment tool started by Netflix. OPA lets you configure policies that dictate what kinds of Spinnaker pipelines developers can create.

Inventors

• Armory

Tutorials

• https://docs.armory.io/spinnaker/policy_engine/

Blogs

• https://blog.armory.io/deployment-policies-with-spinnaker/

Authorization for Java Spring Security

Spring Security provides a framework for securing Java applications. This integration provides a simple implementation of an AccessDecisionVoter for Spring Security that uses OPA for making API authorization decisions.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/spring_authz

Tutorials

• https://github.com/open-policy-agent/contrib/blob/master/spring_authz/README.md

SQL Database Data Filtering

This integration enables the client of a SQL database to enhance a SQL query so that the results obey an OPA-defined policy.

Inventors

• Styra

Code

• https://github.com/open-policy-agent/contrib/tree/master/data_filter_example

Blogs

• https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4

Kubernetes Sysdig Image Scanner Admission Controller

Sysdig’s OPA Image Scanner combines Sysdig Secure image scanner with OPA policy-based rego language to evaluate the scan results and the admission context, providing great flexibility on the admission decision.

Inventors

• Sysdig

Code

• https://github.com/sysdiglabs/opa-image-scanner

Terraform Authorization

Terraform lets you describe the infrastructure you want and automatically creates, deletes, and modifies your existing infrastructure to match. OPA makes it possible to write policies that test the changes Terraform is about to make before it makes them.

Inventors

• Medallia
• Styra
• Docker
• Snyk

Code

• https://github.com/instrumenta/conftest

Tutorials

• https://www.openpolicyagent.org/docs/terraform.html
• https://github.com/instrumenta/conftest/blob/master/README.md

Traefik API Gateway

The Traefik API Gateway is open-source software that controls API traffic into your application. OPA can be configured as a plugin to implement authorization policies for those APIs.

Blogs

• https://engineering.etermax.com/api-authorization-with-kubernetes-traefik-and-open-policy-agent-23647fc384a1