SlideShare a Scribd company logo
Copyright ©2021 Styra, Inc. | All Rights Reserved
Creators of Open Policy Agent
Simplify Open Policy Agent
with Styra DAS
Tim Hinrichs
CTO, co-founder Styra
co-creator OPA
@tlhinrichs
Copyright ©2021 Styra, Inc. | All Rights Reserved
Adoption of the Cloud-native Software Stack is Skyrocketing
Linux
Tekton
Github Actions
CICD
Container Management
Microservices / Apps
Databases
Public Cloud
Servers
Platform
App
CICD Pipeline
1 2 3 4
Gateway
Frontend
Backend
DB
App
2
Copyright ©2021 Styra, Inc. | All Rights Reserved
Authorization Happens Everywhere in the Cloud-native Stack
Linux
Tekton
Github Actions
CICD
Container Management
Microservices / Apps
Databases
Public Cloud
Servers
Platform
App
CICD Pipeline
1 2 3 4
Gateway
Frontend
Backend
DB
App
3
Can user Alice withdraw money from account 123?
Can service 456 request invoices from service 789 on
behalf of alice?
Can user Alice query the finance database?
Which rows and fields can service 456 request on
behalf of alice?
Does this application configuration meet company
standards?
Can the payments service be deployed to this
cluster?
Can pods in namespace payments run as
privileged?
Can this cluster send outbound requests to IP
13.6.0.1?
Are S3 buckets in account 1234 allowed to be
public?
Can EBS volumes for the payments app be
unencrypted?
Who can SSH to production servers?
Copyright ©2021 Styra, Inc. | All Rights Reserved
Two Classes of Authorization: Application and Platform
Linux
Tekton
Github Actions
CICD
Container Management
Microservices / Apps
Databases
Public Cloud
Servers
Platform
App
CICD Pipeline
1 2 3 4
Gateway
Frontend
Backend
DB
App
4
Application Authorization
Platform Authorization

Recommended for you

apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...

apidays LIVE India 2021 - Connecting 1.3 billion digital innovators May 20, 2021 Asynchronous and Broadcasting APIs using Kafka Rohit Saxena, Software Development Consultant at Guardian Life

apidays indiaapidaysapidaysindia
An Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking ArchitectureAn Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking Architecture

Watch the on-demand webinar here: https://wso2.com/library/webinars/an-entry-point-to-impactful-open-banking-architecture/ Description: Banks in Europe, the UK, and Australia have been hard at work prototyping new use cases and operating models that leverage open data and collaboration. In regions like Africa, Latin America, and South and Southeast Asia, we are seeing customer demand and shifting expectations drive increased adoption of open banking models, even where regulation doesn't explicitly require it. A growing number of fintechs and “challenger banks” have emerged seeking to capitalize on customers looking for easier and more intuitive financial experiences. In this deck we’ll cover how you can make the most of these developments and invest in the long term. Discussion topics include: Open banking fundamentals as relevant to systems design with reference to PSD2 specifications and the Australian Consumer Data Standards, along with related concepts from the GDPR regime. Open banking reference architectures to create adaptable open APIs, open data, and open platforms for technical and business agility. Leveraging internal capabilities and data to craft a competitive advantage. Beyond open banking - Banking Product Design Canvas, the Banking 4.0: Digital Factory, and the SMB Capability Uplift.

 
by WSO2
openbanking australiaopen bankingfintechs
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...

apidays LIVE Hong Kong 2021 - API Ecosystem & Data Interchange August 25 & 26, 2021 Digital Identity Centric Approach to Accelerate HKMA OpenAPI Phase3/4 Compliance Ajay Biyani, Regional Vice President, ASEAN at ForgeRock

financial services & apisapidaysapidays hong kong
Copyright ©2021 Styra, Inc. | All Rights Reserved
Open Policy Agent: Unified Authorization, Proven in Production
Linux
Tekton
Github Actions
Platform
App
CICD Pipeline
1 2 3 4
Gateway
Frontend
Backend
DB
App
OPA OPA
OPA
OPA
OPA
OPA
5
Copyright ©2021 Styra, Inc. | All Rights Reserved
Styra DAS: Operationalize OPA for the Enterprise
Linux
Tekton
Github Actions
OPA OPA
OPA
OPA
OPA
OPA
World’s first management plane
for Open Policy Agent
Vertically-integrated policy
lifecycle management
Enterprise-grade governance
Declarative
Authorization
Service
6
Copyright ©2021 Styra, Inc. | All Rights Reserved
Open Policy Agent Community
Open Policy Agent (OPA)
Cloud-native policy engine
Contributors: 30+
companies, 150+ devs
Founded by Styra (2016) / Sandbox (2018) / Incubating (2019) / Graduated (2021)
GitHub Stars
5000
Downloads
80M
Slack Users
4000
Sessions at KubeCon US 2019
● Yelp - How Yelp moved security from the app to the
mesh
● Google - Enforcing service mesh structure using OPA
● Goldman Sachs - K8s policy enforcement using OPA at
Goldman Sachs
● Snyk - Applying policy throughout the app lifecycle with
OPA
● Reddit - Kubernetes at Reddit: Tales from Production
● Adobe - What Makes A Good Multi Tenant Kubernetes
Solution
● Giant Swarm - Using OPA for complex CRD Validation
and Defaulting
OPA Summit at KubeCon US 2019
● Capital One - Open Policy Agent for Policy-enabled
Kubernetes and CICD
● Chef - Open Policy Agent in Practice: From Angular to
OPA in Chef Automate
● Pinterest - Open Policy Agent at Scale: How Pinterest
Manages Policy Distribution
● Tripadvisor - Building a Testing Framework for
Integrating Open Policy Agent into Kubernetes
● Atlassian - Deploying Open Policy Agent at Atlassian
Sessions at Virtual KubeCon EU 2020
● AquaSecurity: Handling Container Vulnerabilities with
Open Policy Agent
● ABN AMRO: How ABN AMRO Switched Cloud
Providers Without Anyone Noticing
● Medudoc: Securing Your Healthcare Data with OPA
Other events or public confirmation of using OPA: Bank of New
York Mellon, AWS, Synemedia, Pure Storage, VMware, Netflix,
Daimler, T-Mobile, Salesforce
Vendor-neutral open-source Growing Community Active End-users
Copyright ©2021 Styra, Inc. | All Rights Reserved
OPA’s flexibility and DAS for Management
Sidecar /
Daemon
Service
OP
A
Server
Library
(Go or
WASM)
Service
OP
A
Server
Centralized
Service
CLI
Server
Service
$ opa eval
Service
Server
OP
A
OP
A
OP
A
Architectural
Flexibility
Team A’s policies Team B’s policies Common library
Policy
Composition
Flexibility
Management
Flexibility
Declarative
Authorization
Service

Recommended for you

[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...

This deck will cover the key aspects of how Chakray helps customers to digitally transform their business using WSO2 technology with proper agile and CI/CD practices. Join us at a city near you to learn how to achieve API-driven integration agility. https://wso2.com/integration-summits-2019/

 
by WSO2
devopsci/cdwso2 platform
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...

apidays LIVE India 2021 - Connecting 1.3 billion digital innovators May 20, 2021 Digital Trust Infrastructure - Key to digital transformation Ramesh Narayanan, CTO at Modular Open Source Identity Platform (MOSIP)

apidays indiaapidaysapidaysindia
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking

This document discusses digital supply chains in banking enabled by APIs and open banking. It introduces open banking and how APIs act as connectors within a bank's ecosystem of consumers, product owners, regulators, and other partners. The digital lifecycle from discovery to experience is described. The document then discusses Intellect Design Arena's partnership with WSO2 to deliver an open banking solution for a UK bank client, including implementing PSD2, security architecture, and certifications achieved.

 
by WSO2
apisfinservfintech
Copyright ©2021 Styra, Inc. | All Rights Reserved
DAS: Policy Management for Individual Users and Teams
9
Enterprise
governance
Policy changes: roll out new policies
slowly and help teams prepare
Multi-team dependencies: policies are
stored in each team’s home repo but are
deployed as a unit
Author
Rego
Schemas
Modularize
Test
Assemble
Test
Impact
Deploy
Policy
Data
Dependency
Monitor
Health
Decisions
OPA
Integrate
Configure
Harden
Policy
lifecycle
management
Policy overrides: enforce global policies but
empower teams to add their own
Visibility: let security, compliance, operations know
which policies are enforced in which systems at a
glance so they can review & troubleshoot
Audit: Prove to auditors that the
policies you have are making the
decisions they should.
Sustainability: Ensure your OPA
deployment adapts to new teams &
software and outlives its creators’
tenure
CICD team
K8s team
LOB Team
Cloud team
Security
Compliance
Declarative
Authorization
Service
Copyright ©2021 Styra, Inc. | All Rights Reserved
Native DAS Support for Leading OPA Use Cases
DESIRED
STATE
k8s API
Server
Pod
Network
Policy
Volumes
OPA
Protect k8s compute,
network, storage, app
configuration
OPA
Protect public cloud
configuration
Service A Service B
OPA OPA
Protect inbound and
outbound
microservice APIs
Custom
Service
OPA
Protect your custom
resources and API
calls
Copyright ©2021 Styra, Inc. | All Rights Reserved
Creators of Open Policy Agent
Open Policy Agent
openpolicyagent.org
@openpolicyagent
Styra
styra.com
@styrainc
Tim Hinrichs
CTO, co-founder Styra
co-creator OPA
@tlhinrichs
Copyright ©2021 Styra, Inc. | All Rights Reserved
Creators of Open Policy Agent
Popular OPA/DAS Use Cases

Recommended for you

INTERFACE, by apidays - A cloud-native approach for open banking in action b...
INTERFACE, by apidays  - A cloud-native approach for open banking in action b...INTERFACE, by apidays  - A cloud-native approach for open banking in action b...
INTERFACE, by apidays - A cloud-native approach for open banking in action b...

This document discusses open APIs in financial services and a cloud-native approach. It covers how open APIs allow for new functionalities, partnerships, and innovation. A cloud-native approach using microservices and containerization is presented as a modern architecture for building APIs. Examples of Red Hat products and solutions for open banking APIs and sandboxes are also provided. The presentation concludes with a Q&A section and links to additional resources.

apidaysinterface by apidaysapi product
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...

apidays LIVE Hong Kong 2021 - API Ecosystem & Data Interchange August 25 & 26, 2021 Modernizing Monolith Applications with API Architecture John Yeung, EASG Committee at Hong Kong Computer Society

architecting apisapidaysapidays hong kong
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...

This document discusses the benefits of using open source software to manage API lifecycles. It notes that digital transformation requires integrating new technologies rapidly, which open source allows through wider collaboration and input. Open source ensures better security, transparency, and extensibility. It also leads to higher quality code through more eyeballs and passionate developers. Open source APIs are also more cost effective and support corporate social responsibility goals. The document cites WSO2 as an example of an open source API management vendor that contributes significantly to many open source projects.

 
by WSO2
api managementapidaysopen source
Copyright ©2021 Styra, Inc. | All Rights Reserved
Native DAS Support for Leading OPA Use Cases
DESIRED
STATE
k8s API
Server
Pod
Network
Policy
Volumes
OPA
Protect k8s compute,
network, storage, app
configuration
OPA
Protect public cloud
configuration
Service A Service B
OPA OPA
Protect inbound and
outbound
microservice APIs
Custom
Service
OPA
Protect your custom
resources and API
calls
Copyright ©2021 Styra, Inc. | All Rights Reserved
Kubernetes Challenges
OPERATIONS SECURITY COMPLIANCE
CICD well implemented, policy
defined, protected against
mistakes
Prove what has been
blocked/allowed over time. Easy
reporting, extremely detailed
historical checks
Wrong app accepting web
traffic, improper egress,
improper permissions….
Not including liveness probes on
pods
Failing to specify encrypted
storage
Duplicating paths/names so traffic
goes to the wrong service
Running containers
as privileged
Setting up network connections to
non-approved IPs / Internet
Runaway resource usage because no
limits were specified
Failing to include proper labels
required for traffic control
Running Images from
Unauthorized Registries
Copyright ©2021 Styra, Inc. | All Rights Reserved
Styra DAS: Push-button Authorization Controls for K8s
15
DESIRED
STATE
API
Server
RUNTIME STATE
DESIRED
STATE
API
Server
RUNTIME STATE
...
Open Policy Agent
● makes decisions locally and logs centrally
● flexible policy language
● vendor-neutral open-source (CNCF)
Declarative
Authorization
Service
OPA
OPA
Styra DAS
● OPA control plane
● 100+ Pre-built policies
● PCI, MITRE, PSP, CIS packs
● install in under 5 minutes
● multi-cluster policy authoring
● impact analysis
Support
all k8s
flavors
Copyright ©2021 Styra, Inc. | All Rights Reserved
Terraform Challenges
OPERATIONS SECURITY COMPLIANCE
CICD well implemented, policy
defined, protected against
mistakes
Prove what has been
blocked/allowed over time. Easy
reporting, extremely detailed
historical checks
Wrong app accepting web
traffic, improper egress,
improper permissions….
Failing to specify encrypted
storage
Duplicating paths/names so traffic
goes to the wrong service
Setting up network connections to
non-approved IPs / Internet
Runaway resource usage because no
limits were specified
Failing to include proper labels for
chargeback
Running unauthorized VM
images

Recommended for you

[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World

This deck discusses how APIs are touching every facet of our society and the underlying trends that are going to generate nearly 1 billion APIs in the coming years. All digital transformation is now API-driven and integration technologies underpin their evolution. Join us at a city near you to learn how to achieve API-driven integration agility. - https://wso2.com/integration-summits-2019/

 
by WSO2
api-drivendigital transformationopen source
Best Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated TestingBest Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated Testing

When productizing your APIs to create new sources of revenue or to improve user experience with modern apps or services, your toughest challenge will likely come from ensuring API quality as you accelerate up to DevOps speeds. Along with a much faster time to market, you will need to handle the high complexity and potential costs and security risks that come with a proliferation of integrations. Increasingly, companies are solving their quality-at-speed challenges with continuous API management that extend across the whole product lifecycle. However, continuous API management leaves QA vulnerabilities that can only be covered by the right continuous testing solution. Join this webinar to learn what those vulnerabilities look like, and how to unify API management and API testing to solve the problem via two cloud-native platforms. Simplify QA in the product lifecycle through Design, Build, Test, and Release, and enforce a standardized testing/QA policy across the entire organization. The slide deck will showcase: - What makes a good API product - The API product mantra - The importance of API testing - How companies can achieve quality at DevOps speed - How to release more reliable, better-performing APIs Watch the on-demand webinar here - https://wso2.com/library/webinars/best-practices-for-productizing-apis-with-api-management-and-automated-testing/

 
by WSO2
productizing apiswso2 api managerapi management
API-first Integration for Microservices
API-first Integration for MicroservicesAPI-first Integration for Microservices
API-first Integration for Microservices

Digital transformation is the integration of digital technology into all areas of a business, fundamentally changing how you operate and deliver value to customers. It's also a cultural change that requires organizations to continually challenge the status quo, experiment, and get comfortable with failure. It is essential that you integrate digital technology into all areas of business so that your business can be agile and adapts to changing circumstances. Microservices architecture gives you the agility required to build a digital business, while APIs are the enablers for turning a conventional business into a digital business. In this webinar, we will discuss how an enterprise can adopt an API-first approach for building a digital business leveraging microservices architecture. We will explain and show the business benefits of: - An API-first approach for building a digital business - How microservices enables business agility - Building and integrating your microservices - Modernization of your legacy applications - How to leverage the WSO2 API integration platform to build a digital business. Watch the webinar on-demand here - https://wso2.com/library/webinars/api-first-integration-for-microservices/

 
by WSO2
wso2 webinarsyenlomicroservices
Copyright ©2021 Styra, Inc. | All Rights Reserved
Styra DAS: Authorization Controls for Terraform
17
Open Policy Agent
● makes decisions locally and logs centrally
● provides flexible policy language
● vendor-neutral open-source (CNCF)
Declarative
Authorization
Service
OPA
Styra DAS
● policy assembly from multiple
sources of truth
● distribution of policy to OPA
● audit log of decisions
● dry-runs policy changes
Desired
State
Planned
Changes
terraform plan terraform apply
Copyright ©2021 Styra, Inc. | All Rights Reserved
Microservice Authorization Challenges
Can Alice see the list of
outgoing payments?
18
Service A
Service B
Service C
Can service A ask for Alice’s
profile on behalf of Alice?
Can service A ask for Hooli’s outgoing
payments on behalf of Alice?
On every API call, every microservice makes an authorization decision
Authz Implementation Challenges
● Different languages across
services.
● Centralized service is too slow
for microservices
● New services/teams should
snap into framework
● Security/compliance should be
able to audit policies
● Journey from coarse-grained
permissions to fine-grained and
from gateway enforcement to
microservice enforcement
Copyright ©2021 Styra, Inc. | All Rights Reserved
Styra DAS: Authorization Sidecar Plus Control Plane
19
Service A
Service B
Service C
Open Policy Agent
● makes decisions locally and logs centrally
● flexible policy language
● vendor-neutral open-source (CNCF)
Declarative
Authorization
Service
OPA
OPA
OPA
Styra DAS
● OPA control plane
● distributes policies
● monitors OPAs
● team-based policy authoring
● impact analysis
Copyright ©2021 Styra, Inc. | All Rights Reserved
Creators of Open Policy Agent
FAQ

Recommended for you

apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...

apidays LIVE Paris 2021 - APIs and the Future of Software December 7, 8 & 9, 2021 API4IPS - API essentials for public sector innovation Legal and organisational essentials December 2021 European Commission – Joint Research Centre Katarzyna Pogorzelska, Legal and Policy Officer Monica Posada-Sanchez, Project Manager of the API Study, Senior Researcher

apidays live parisapidays pariseuropean digital strategy
API Security Best Practices and Guidelines
API Security Best Practices and GuidelinesAPI Security Best Practices and Guidelines
API Security Best Practices and Guidelines

View on-demand: https://wso2.com/library/webinars/api-security-best-practices-and-guidelines/ Modern enterprises are increasingly adopting APIs, exceeding all predictions. With more businesses investing in microservices and the increased consumption of cloud APIs, you need to secure beyond just a handful of well-known APIs. You will need to secure a higher number of internal and external endpoints. At the same time, security itself is a broad area and vendors implement a number of seemingly similar standards and patterns, making it very difficult for consumers to settle on the best option for securing APIs. The sheer number of options can be very confusing. There is much to learn about API security, regardless of whether you are a novice or expert and it’s extremely important that you do because security is an integral part of any development project, including API ecosystems. This webinar will deep-dive into the importance of API security, API security patterns, and how identity and access management (IAM) fit in the ecosystem. DURING THE WEBINAR, WE WILL COVER: Managed APIs OAuth 2.0 and API security patterns Introduction to WSO2 Identity Server How we align with OWASP API security guidelines

 
by WSO2
ciamtop iam solutionsidentity and access management
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...

apidays LIVE Hong Kong 2021 - API Ecosystem & Data Interchange August 25 & 26, 2021 Next Stage for Open API at Banking Industry Nicky Ng, Architect at IBM

apidaysapidays hong kongapidays live hong kong
Copyright ©2021 Styra, Inc. | All Rights Reserved
What does Policy-as-code mean and what does OPA provide?
21
Communicate
Policies written in file
format that people AND a
policy engine understand.
● Precise
● Dry-runnable
● Portable
Enforce
Policy engine integrated
into software and uses
policies to make
authorization decisions
● Fast
● Comprehensive
● Correct
Audit
Policy engine records all
decisions and can be
analyzed like any data
● Always-on
● Comprehensive
● Deep
Govern
Policy files have a lifecycle
(approval, test, build,
deploy) for governance.
● Manual &
Automated
● Granular
Policy-as-Code Approach to Authorization
21
OPA
Provides
.rego
Policy file
+
Policy engine
OPA
Policy tools
+
Copyright ©2021 Styra, Inc. | All Rights Reserved
How does OPA work?
Service
OP
A
Policy
(Rego)
Data
(JSON)
Request
Policy
Decision
Policy
Query
Input can be ANY JSON value Output can be ANY JSON value
OPA makes decisions.
Service enforces decisions.
Linux
22
Copyright ©2021 Styra, Inc. | All Rights Reserved
What does an OPA policy for Kubernetes look like?
package kubernetes.admission
deny[msg] {
input.request.kind.kind == "Pod"
some i
image := input.request.object.spec.containers[i].image
not startswith(image, "hooli.com/")
msg := sprintf("image comes from bad registry: %v", [image])
}
apiVersion: admission.k8s.io/v1beta1
kind: AdmissionReview
request:
kind:
group: ''
kind: Pod
version: v1
namespace: opa
object:
metadata:
labels:
app: nginx
name: nginx
namespace: opa
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: nginx
operation: CREATE
JSON/YAML from Kubernetes
OPA Policy: All images come from a trusted registry
OPA Playground
Copyright ©2021 Styra, Inc. | All Rights Reserved
What does an OPA policy for Envoy look like?
package envoy.authz
# everyone can GET /
allow {
input.attributes.request.http.method == "GET"
input.parsed_path = ["/"]
}
# updates to /v1/admin/{id} dependent on source IP
allow {
input.attributes.request.http.method == "PUT"
input.parsed_path = ["v1", "admin", id]
user_is_admin
src := input.attributes.source.address.Address.SocketAddress.address
net.cidr_contains("172.28.0.0/16", src)
}
user_is_admin { ... }
parsed_path: [“api”, “v1”, “products”]
attributes:
source:
address:
Address:
SocketAddress:
address: "172.17.0.10"
PortSpecifier:
PortValue: 36472
destination:
address:
Address:
SocketAddress:
address: "172.17.0.17"
PortSpecifier:
PortValue: 9080
request:
http:
id: 13359530607844510314
method: GET
headers: ...
path: "/api/v1/products"
host: "192.168.99.100:31380"
protocol: "HTTP/1.1"
JSON/YAML from Envoy
OPA Policy: Allow all GET and some PUT
OPA Playground

Recommended for you

INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...

David Wobrock presented on Botify's custom 'Big Data' JSON DSL API. The API allows customers to query, join, and aggregate multiple datasets containing SEO data through a custom JSON query language. This unified API approach enables growth by giving customers access to Botify's full dataset to address business needs. Key lessons learned include the steep learning curve for the custom DSL, the importance of monitoring API usage, and improving developer relations to support API integration and adoption.

apidaysinterface by apidaysapi infrastructure
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...

apidays LIVE Hong Kong 2021 - API Ecosystem & Data Interchange August 25 & 26, 2021 API Ecosystem and Banking Open API Phase III & IV Carl Seto, Director, Product and Marketing at JETCO

financial services & apisapidaysapidays hong kong
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...

The document discusses using Open Policy Agent (OPA) for microservice application authorization. It describes the new authorization challenges of moving from monoliths to microservices, and how OPA can be used to enforce consistent authorization policies across microservices through a service mesh. It provides examples of how OPA policies can be used for user authorization, service authorization, and context-aware authorization.

apidaysapidays new yorkapidays live new york
Copyright ©2021 Styra, Inc. | All Rights Reserved
Creators of Open Policy Agent
Thanks!

More Related Content

What's hot

apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
apidays
 
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
apidays
 
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
apidays
 
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays
 
An Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking ArchitectureAn Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking Architecture
WSO2
 
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays
 
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
WSO2
 
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays
 
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
WSO2
 
INTERFACE, by apidays - A cloud-native approach for open banking in action b...
INTERFACE, by apidays  - A cloud-native approach for open banking in action b...INTERFACE, by apidays  - A cloud-native approach for open banking in action b...
INTERFACE, by apidays - A cloud-native approach for open banking in action b...
apidays
 
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays
 
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
WSO2
 
[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World
WSO2
 
Best Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated TestingBest Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated Testing
WSO2
 
API-first Integration for Microservices
API-first Integration for MicroservicesAPI-first Integration for Microservices
API-first Integration for Microservices
WSO2
 
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays
 
API Security Best Practices and Guidelines
API Security Best Practices and GuidelinesAPI Security Best Practices and Guidelines
API Security Best Practices and Guidelines
WSO2
 
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays
 
INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...
apidays
 
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays
 

What's hot (20)

apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
apidays LIVE New York 2021 - API Economy in Financial Services by Giovanni Le...
 
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
apidays LIVE Australia 2021 - Leveraging Async APIs to deliver Cross Domain A...
 
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
apidays LIVE New York 2021 - Managing the usage of Asynchronous APIs: What do...
 
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...
 
An Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking ArchitectureAn Entry Point to Impactful Open Banking Architecture
An Entry Point to Impactful Open Banking Architecture
 
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
apidays LIVE Hong Kong 2021 - Digital Identity Centric Approach to Accelerate...
 
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
[WSO2 Integration Summit Singapore 2019] Achieving Predictable Success in Dig...
 
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
apidays LIVE India - Digital Trust Infrastructure - Key to digital transforma...
 
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
[WSO2 Summit EMEA 2020] Experiencing the Benefits of API Driven Open Banking
 
INTERFACE, by apidays - A cloud-native approach for open banking in action b...
INTERFACE, by apidays  - A cloud-native approach for open banking in action b...INTERFACE, by apidays  - A cloud-native approach for open banking in action b...
INTERFACE, by apidays - A cloud-native approach for open banking in action b...
 
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
apidays LIVE Hong Kong 2021 - Modernizing Monolith Applications with API Arch...
 
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...
 
[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World[WSO2 Integration Summit Singapore 2019] The API-driven World
[WSO2 Integration Summit Singapore 2019] The API-driven World
 
Best Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated TestingBest Practices for Productizing APIs with API Management and Automated Testing
Best Practices for Productizing APIs with API Management and Automated Testing
 
API-first Integration for Microservices
API-first Integration for MicroservicesAPI-first Integration for Microservices
API-first Integration for Microservices
 
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
apidays LIVE Paris 2021 - API4IPS - API essentials for Public Sector Innovati...
 
API Security Best Practices and Guidelines
API Security Best Practices and GuidelinesAPI Security Best Practices and Guidelines
API Security Best Practices and Guidelines
 
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
apidays LIVE Hong Kong 2021 - Next Stage for Open API at Banking Industry by ...
 
INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...INTERFACE, by apidays  - Lessons learned from implementing our custom ‘Big Da...
INTERFACE, by apidays - Lessons learned from implementing our custom ‘Big Da...
 
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
apidays LIVE Hong Kong 2021 - API Ecosystem and Banking Open API Phase III & ...
 

Similar to apidays LIVE New York 2021 - Simplify Open Policy Agent with Styra DAS by Tim Hinrichs, Styra

apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays
 
Addressing Challenges with IoT Edge Management
Addressing Challenges with IoT Edge ManagementAddressing Challenges with IoT Edge Management
Addressing Challenges with IoT Edge Management
DataWorks Summit
 
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google CloudTechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
Robb Boyd
 
Migration to microsoft_azure_with_zscaler
Migration to microsoft_azure_with_zscalerMigration to microsoft_azure_with_zscaler
Migration to microsoft_azure_with_zscaler
Zscaler
 
Introducing Cloudera DataFlow (CDF) 2.13.19
Introducing Cloudera DataFlow (CDF) 2.13.19Introducing Cloudera DataFlow (CDF) 2.13.19
Introducing Cloudera DataFlow (CDF) 2.13.19
Cloudera, Inc.
 
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAPSecuring Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Olivia LaMar
 
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
Amazon Web Services
 
Big Data Fundamentals 6.6.18
Big Data Fundamentals 6.6.18Big Data Fundamentals 6.6.18
Big Data Fundamentals 6.6.18
Cloudera, Inc.
 
Big Data Fundamentals
Big Data FundamentalsBig Data Fundamentals
Big Data Fundamentals
Cloudera, Inc.
 
Secure Clouds are Happy Clouds
Secure Clouds are Happy CloudsSecure Clouds are Happy Clouds
Secure Clouds are Happy Clouds
2nd Watch
 
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdfCNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
LibbySchulze
 
AWS November meetup Slides
AWS November meetup SlidesAWS November meetup Slides
AWS November meetup Slides
JacksonMorgan9
 
AWS User Group November
AWS User Group NovemberAWS User Group November
AWS User Group November
PolarSeven Pty Ltd
 
Compliance and Zero Trust Ambient Mesh
Compliance and Zero Trust Ambient MeshCompliance and Zero Trust Ambient Mesh
Compliance and Zero Trust Ambient Mesh
Christian Posta
 
Veritas + MongoDB
Veritas + MongoDBVeritas + MongoDB
Veritas + MongoDB
MongoDB
 
The rise of microservices
The rise of microservicesThe rise of microservices
The rise of microservices
Cloud Technology Experts
 
The Cloud Foundry Story
The Cloud Foundry StoryThe Cloud Foundry Story
The Cloud Foundry Story
VMware Tanzu
 
Meetup Streaming Data Pipeline Development
Meetup Streaming Data Pipeline DevelopmentMeetup Streaming Data Pipeline Development
Meetup Streaming Data Pipeline Development
Timothy Spann
 
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
ssuser73434e
 
Delivering Network Innovation with SDN - Tom Nadeau
Delivering Network Innovation with SDN - Tom Nadeau Delivering Network Innovation with SDN - Tom Nadeau
Delivering Network Innovation with SDN - Tom Nadeau
scoopnewsgroup
 

Similar to apidays LIVE New York 2021 - Simplify Open Policy Agent with Styra DAS by Tim Hinrichs, Styra (20)

apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
apidays LIVE New York 2021 - Microservice Authorization with Open Policy Agen...
 
Addressing Challenges with IoT Edge Management
Addressing Challenges with IoT Edge ManagementAddressing Challenges with IoT Edge Management
Addressing Challenges with IoT Edge Management
 
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google CloudTechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
 
Migration to microsoft_azure_with_zscaler
Migration to microsoft_azure_with_zscalerMigration to microsoft_azure_with_zscaler
Migration to microsoft_azure_with_zscaler
 
Introducing Cloudera DataFlow (CDF) 2.13.19
Introducing Cloudera DataFlow (CDF) 2.13.19Introducing Cloudera DataFlow (CDF) 2.13.19
Introducing Cloudera DataFlow (CDF) 2.13.19
 
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAPSecuring Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
 
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
A New Approach to Continuous Monitoring in the Cloud: Migrate to AWS with NET...
 
Big Data Fundamentals 6.6.18
Big Data Fundamentals 6.6.18Big Data Fundamentals 6.6.18
Big Data Fundamentals 6.6.18
 
Big Data Fundamentals
Big Data FundamentalsBig Data Fundamentals
Big Data Fundamentals
 
Secure Clouds are Happy Clouds
Secure Clouds are Happy CloudsSecure Clouds are Happy Clouds
Secure Clouds are Happy Clouds
 
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdfCNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
 
AWS November meetup Slides
AWS November meetup SlidesAWS November meetup Slides
AWS November meetup Slides
 
AWS User Group November
AWS User Group NovemberAWS User Group November
AWS User Group November
 
Compliance and Zero Trust Ambient Mesh
Compliance and Zero Trust Ambient MeshCompliance and Zero Trust Ambient Mesh
Compliance and Zero Trust Ambient Mesh
 
Veritas + MongoDB
Veritas + MongoDBVeritas + MongoDB
Veritas + MongoDB
 
The rise of microservices
The rise of microservicesThe rise of microservices
The rise of microservices
 
The Cloud Foundry Story
The Cloud Foundry StoryThe Cloud Foundry Story
The Cloud Foundry Story
 
Meetup Streaming Data Pipeline Development
Meetup Streaming Data Pipeline DevelopmentMeetup Streaming Data Pipeline Development
Meetup Streaming Data Pipeline Development
 
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
Future of Data Milwaukee Meetup Streaming Data Pipeline Development 28 June 2023
 
Delivering Network Innovation with SDN - Tom Nadeau
Delivering Network Innovation with SDN - Tom Nadeau Delivering Network Innovation with SDN - Tom Nadeau
Delivering Network Innovation with SDN - Tom Nadeau
 

More from apidays

Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
apidays
 
Apidays Helsinki 2024 - APIs ahoy, the case of Customer Booking APIs in Finn...
Apidays Helsinki 2024 -  APIs ahoy, the case of Customer Booking APIs in Finn...Apidays Helsinki 2024 -  APIs ahoy, the case of Customer Booking APIs in Finn...
Apidays Helsinki 2024 - APIs ahoy, the case of Customer Booking APIs in Finn...
apidays
 
Apidays Helsinki 2024 - From Chaos to Calm- Navigating Emerging API Security...
Apidays Helsinki 2024 -  From Chaos to Calm- Navigating Emerging API Security...Apidays Helsinki 2024 -  From Chaos to Calm- Navigating Emerging API Security...
Apidays Helsinki 2024 - From Chaos to Calm- Navigating Emerging API Security...
apidays
 
Apidays Helsinki 2024 - What is next now that your organization created a (si...
Apidays Helsinki 2024 - What is next now that your organization created a (si...Apidays Helsinki 2024 - What is next now that your organization created a (si...
Apidays Helsinki 2024 - What is next now that your organization created a (si...
apidays
 
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
apidays
 
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
apidays
 
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
apidays
 
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
apidays
 
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
apidays
 
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, OsaangoApidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
apidays
 
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
apidays
 
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, ZuploApidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
apidays
 
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
apidays
 
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss AdamsApidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
apidays
 
Apidays New York 2024 - Prototype-first - A modern API development workflow b...
Apidays New York 2024 - Prototype-first - A modern API development workflow b...Apidays New York 2024 - Prototype-first - A modern API development workflow b...
Apidays New York 2024 - Prototype-first - A modern API development workflow b...
apidays
 
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
apidays
 
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
apidays
 
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, DanoneApidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
apidays
 
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
apidays
 
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
apidays
 

More from apidays (20)

Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...
 
Apidays Helsinki 2024 - APIs ahoy, the case of Customer Booking APIs in Finn...
Apidays Helsinki 2024 -  APIs ahoy, the case of Customer Booking APIs in Finn...Apidays Helsinki 2024 -  APIs ahoy, the case of Customer Booking APIs in Finn...
Apidays Helsinki 2024 - APIs ahoy, the case of Customer Booking APIs in Finn...
 
Apidays Helsinki 2024 - From Chaos to Calm- Navigating Emerging API Security...
Apidays Helsinki 2024 -  From Chaos to Calm- Navigating Emerging API Security...Apidays Helsinki 2024 -  From Chaos to Calm- Navigating Emerging API Security...
Apidays Helsinki 2024 - From Chaos to Calm- Navigating Emerging API Security...
 
Apidays Helsinki 2024 - What is next now that your organization created a (si...
Apidays Helsinki 2024 - What is next now that your organization created a (si...Apidays Helsinki 2024 - What is next now that your organization created a (si...
Apidays Helsinki 2024 - What is next now that your organization created a (si...
 
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
Apidays Helsinki 2024 - There’s no AI without API, but what does this mean fo...
 
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
Apidays Helsinki 2024 - Security Vulnerabilities in your APIs by Lukáš Ďurovs...
 
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
Apidays Helsinki 2024 - Data, API’s and Banks, with AI on top by Sergio Giral...
 
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
Apidays Helsinki 2024 - Data Ecosystems Driving the Green Transition by Olli ...
 
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
Apidays Helsinki 2024 - Bridging the Gap Between Backend and Frontend API Tes...
 
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, OsaangoApidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
Apidays Helsinki 2024 - API Compliance by Design by Marjukka Niinioja, Osaango
 
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
Apidays Helsinki 2024 - ABLOY goes API economy – Transformation story by Hann...
 
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, ZuploApidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
Apidays New York 2024 - The subtle art of API rate limiting by Josh Twist, Zuplo
 
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
Apidays New York 2024 - RESTful API Patterns and Practices by Mike Amundsen, ...
 
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss AdamsApidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
Apidays New York 2024 - Putting AI into API Security by Corey Ball, Moss Adams
 
Apidays New York 2024 - Prototype-first - A modern API development workflow b...
Apidays New York 2024 - Prototype-first - A modern API development workflow b...Apidays New York 2024 - Prototype-first - A modern API development workflow b...
Apidays New York 2024 - Prototype-first - A modern API development workflow b...
 
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
Apidays New York 2024 - Post-Quantum API Security by Francois Lascelles, Broa...
 
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
Apidays New York 2024 - Increase your productivity with no-code GraphQL mocki...
 
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, DanoneApidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
Apidays New York 2024 - Driving API & EDA Success by Marcelo Caponi, Danone
 
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
Apidays New York 2024 - Build a terrible API for people you hate by Jim Benne...
 
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
Apidays New York 2024 - API Secret Tokens Exposed by Tristan Kalos and Antoin...
 

Recently uploaded

Coordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar SlidesCoordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar Slides
Safe Software
 
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptxRPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
SynapseIndia
 
What’s New in Teams Calling, Meetings and Devices May 2024
What’s New in Teams Calling, Meetings and Devices May 2024What’s New in Teams Calling, Meetings and Devices May 2024
What’s New in Teams Calling, Meetings and Devices May 2024
Stephanie Beckett
 
Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
BookNet Canada
 
Best Practices for Effectively Running dbt in Airflow.pdf
Best Practices for Effectively Running dbt in Airflow.pdfBest Practices for Effectively Running dbt in Airflow.pdf
Best Practices for Effectively Running dbt in Airflow.pdf
Tatiana Al-Chueyr
 
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
Toru Tamaki
 
How Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdfHow Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdf
HackersList
 
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-InTrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
TrustArc
 
Manual | Product | Research Presentation
Manual | Product | Research PresentationManual | Product | Research Presentation
Manual | Product | Research Presentation
welrejdoall
 
Calgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptxCalgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptx
ishalveerrandhawa1
 
DealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 editionDealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 edition
Yevgen Sysoyev
 
Best Programming Language for Civil Engineers
Best Programming Language for Civil EngineersBest Programming Language for Civil Engineers
Best Programming Language for Civil Engineers
Awais Yaseen
 
How RPA Help in the Transportation and Logistics Industry.pptx
How RPA Help in the Transportation and Logistics Industry.pptxHow RPA Help in the Transportation and Logistics Industry.pptx
How RPA Help in the Transportation and Logistics Industry.pptx
SynapseIndia
 
How to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptxHow to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptx
Adam Dunkels
 
Observability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetryObservability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetry
Eric D. Schabell
 
Comparison Table of DiskWarrior Alternatives.pdf
Comparison Table of DiskWarrior Alternatives.pdfComparison Table of DiskWarrior Alternatives.pdf
Comparison Table of DiskWarrior Alternatives.pdf
Andrey Yasko
 
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Chris Swan
 
Implementations of Fused Deposition Modeling in real world
Implementations of Fused Deposition Modeling  in real worldImplementations of Fused Deposition Modeling  in real world
Implementations of Fused Deposition Modeling in real world
Emerging Tech
 
Quality Patents: Patents That Stand the Test of Time
Quality Patents: Patents That Stand the Test of TimeQuality Patents: Patents That Stand the Test of Time
Quality Patents: Patents That Stand the Test of Time
Aurora Consulting
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
rajancomputerfbd
 

Recently uploaded (20)

Coordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar SlidesCoordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar Slides
 
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptxRPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
 
What’s New in Teams Calling, Meetings and Devices May 2024
What’s New in Teams Calling, Meetings and Devices May 2024What’s New in Teams Calling, Meetings and Devices May 2024
What’s New in Teams Calling, Meetings and Devices May 2024
 
Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
 
Best Practices for Effectively Running dbt in Airflow.pdf
Best Practices for Effectively Running dbt in Airflow.pdfBest Practices for Effectively Running dbt in Airflow.pdf
Best Practices for Effectively Running dbt in Airflow.pdf
 
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
 
How Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdfHow Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdf
 
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-InTrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
TrustArc Webinar - 2024 Data Privacy Trends: A Mid-Year Check-In
 
Manual | Product | Research Presentation
Manual | Product | Research PresentationManual | Product | Research Presentation
Manual | Product | Research Presentation
 
Calgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptxCalgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptx
 
DealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 editionDealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 edition
 
Best Programming Language for Civil Engineers
Best Programming Language for Civil EngineersBest Programming Language for Civil Engineers
Best Programming Language for Civil Engineers
 
How RPA Help in the Transportation and Logistics Industry.pptx
How RPA Help in the Transportation and Logistics Industry.pptxHow RPA Help in the Transportation and Logistics Industry.pptx
How RPA Help in the Transportation and Logistics Industry.pptx
 
How to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptxHow to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptx
 
Observability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetryObservability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetry
 
Comparison Table of DiskWarrior Alternatives.pdf
Comparison Table of DiskWarrior Alternatives.pdfComparison Table of DiskWarrior Alternatives.pdf
Comparison Table of DiskWarrior Alternatives.pdf
 
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
 
Implementations of Fused Deposition Modeling in real world
Implementations of Fused Deposition Modeling  in real worldImplementations of Fused Deposition Modeling  in real world
Implementations of Fused Deposition Modeling in real world
 
Quality Patents: Patents That Stand the Test of Time
Quality Patents: Patents That Stand the Test of TimeQuality Patents: Patents That Stand the Test of Time
Quality Patents: Patents That Stand the Test of Time
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
 

apidays LIVE New York 2021 - Simplify Open Policy Agent with Styra DAS by Tim Hinrichs, Styra

  • 1. Copyright ©2021 Styra, Inc. | All Rights Reserved Creators of Open Policy Agent Simplify Open Policy Agent with Styra DAS Tim Hinrichs CTO, co-founder Styra co-creator OPA @tlhinrichs
  • 2. Copyright ©2021 Styra, Inc. | All Rights Reserved Adoption of the Cloud-native Software Stack is Skyrocketing Linux Tekton Github Actions CICD Container Management Microservices / Apps Databases Public Cloud Servers Platform App CICD Pipeline 1 2 3 4 Gateway Frontend Backend DB App 2
  • 3. Copyright ©2021 Styra, Inc. | All Rights Reserved Authorization Happens Everywhere in the Cloud-native Stack Linux Tekton Github Actions CICD Container Management Microservices / Apps Databases Public Cloud Servers Platform App CICD Pipeline 1 2 3 4 Gateway Frontend Backend DB App 3 Can user Alice withdraw money from account 123? Can service 456 request invoices from service 789 on behalf of alice? Can user Alice query the finance database? Which rows and fields can service 456 request on behalf of alice? Does this application configuration meet company standards? Can the payments service be deployed to this cluster? Can pods in namespace payments run as privileged? Can this cluster send outbound requests to IP 13.6.0.1? Are S3 buckets in account 1234 allowed to be public? Can EBS volumes for the payments app be unencrypted? Who can SSH to production servers?
  • 4. Copyright ©2021 Styra, Inc. | All Rights Reserved Two Classes of Authorization: Application and Platform Linux Tekton Github Actions CICD Container Management Microservices / Apps Databases Public Cloud Servers Platform App CICD Pipeline 1 2 3 4 Gateway Frontend Backend DB App 4 Application Authorization Platform Authorization
  • 5. Copyright ©2021 Styra, Inc. | All Rights Reserved Open Policy Agent: Unified Authorization, Proven in Production Linux Tekton Github Actions Platform App CICD Pipeline 1 2 3 4 Gateway Frontend Backend DB App OPA OPA OPA OPA OPA OPA 5
  • 6. Copyright ©2021 Styra, Inc. | All Rights Reserved Styra DAS: Operationalize OPA for the Enterprise Linux Tekton Github Actions OPA OPA OPA OPA OPA OPA World’s first management plane for Open Policy Agent Vertically-integrated policy lifecycle management Enterprise-grade governance Declarative Authorization Service 6
  • 7. Copyright ©2021 Styra, Inc. | All Rights Reserved Open Policy Agent Community Open Policy Agent (OPA) Cloud-native policy engine Contributors: 30+ companies, 150+ devs Founded by Styra (2016) / Sandbox (2018) / Incubating (2019) / Graduated (2021) GitHub Stars 5000 Downloads 80M Slack Users 4000 Sessions at KubeCon US 2019 ● Yelp - How Yelp moved security from the app to the mesh ● Google - Enforcing service mesh structure using OPA ● Goldman Sachs - K8s policy enforcement using OPA at Goldman Sachs ● Snyk - Applying policy throughout the app lifecycle with OPA ● Reddit - Kubernetes at Reddit: Tales from Production ● Adobe - What Makes A Good Multi Tenant Kubernetes Solution ● Giant Swarm - Using OPA for complex CRD Validation and Defaulting OPA Summit at KubeCon US 2019 ● Capital One - Open Policy Agent for Policy-enabled Kubernetes and CICD ● Chef - Open Policy Agent in Practice: From Angular to OPA in Chef Automate ● Pinterest - Open Policy Agent at Scale: How Pinterest Manages Policy Distribution ● Tripadvisor - Building a Testing Framework for Integrating Open Policy Agent into Kubernetes ● Atlassian - Deploying Open Policy Agent at Atlassian Sessions at Virtual KubeCon EU 2020 ● AquaSecurity: Handling Container Vulnerabilities with Open Policy Agent ● ABN AMRO: How ABN AMRO Switched Cloud Providers Without Anyone Noticing ● Medudoc: Securing Your Healthcare Data with OPA Other events or public confirmation of using OPA: Bank of New York Mellon, AWS, Synemedia, Pure Storage, VMware, Netflix, Daimler, T-Mobile, Salesforce Vendor-neutral open-source Growing Community Active End-users
  • 8. Copyright ©2021 Styra, Inc. | All Rights Reserved OPA’s flexibility and DAS for Management Sidecar / Daemon Service OP A Server Library (Go or WASM) Service OP A Server Centralized Service CLI Server Service $ opa eval Service Server OP A OP A OP A Architectural Flexibility Team A’s policies Team B’s policies Common library Policy Composition Flexibility Management Flexibility Declarative Authorization Service
  • 9. Copyright ©2021 Styra, Inc. | All Rights Reserved DAS: Policy Management for Individual Users and Teams 9 Enterprise governance Policy changes: roll out new policies slowly and help teams prepare Multi-team dependencies: policies are stored in each team’s home repo but are deployed as a unit Author Rego Schemas Modularize Test Assemble Test Impact Deploy Policy Data Dependency Monitor Health Decisions OPA Integrate Configure Harden Policy lifecycle management Policy overrides: enforce global policies but empower teams to add their own Visibility: let security, compliance, operations know which policies are enforced in which systems at a glance so they can review & troubleshoot Audit: Prove to auditors that the policies you have are making the decisions they should. Sustainability: Ensure your OPA deployment adapts to new teams & software and outlives its creators’ tenure CICD team K8s team LOB Team Cloud team Security Compliance Declarative Authorization Service
  • 10. Copyright ©2021 Styra, Inc. | All Rights Reserved Native DAS Support for Leading OPA Use Cases DESIRED STATE k8s API Server Pod Network Policy Volumes OPA Protect k8s compute, network, storage, app configuration OPA Protect public cloud configuration Service A Service B OPA OPA Protect inbound and outbound microservice APIs Custom Service OPA Protect your custom resources and API calls
  • 11. Copyright ©2021 Styra, Inc. | All Rights Reserved Creators of Open Policy Agent Open Policy Agent openpolicyagent.org @openpolicyagent Styra styra.com @styrainc Tim Hinrichs CTO, co-founder Styra co-creator OPA @tlhinrichs
  • 12. Copyright ©2021 Styra, Inc. | All Rights Reserved Creators of Open Policy Agent Popular OPA/DAS Use Cases
  • 13. Copyright ©2021 Styra, Inc. | All Rights Reserved Native DAS Support for Leading OPA Use Cases DESIRED STATE k8s API Server Pod Network Policy Volumes OPA Protect k8s compute, network, storage, app configuration OPA Protect public cloud configuration Service A Service B OPA OPA Protect inbound and outbound microservice APIs Custom Service OPA Protect your custom resources and API calls
  • 14. Copyright ©2021 Styra, Inc. | All Rights Reserved Kubernetes Challenges OPERATIONS SECURITY COMPLIANCE CICD well implemented, policy defined, protected against mistakes Prove what has been blocked/allowed over time. Easy reporting, extremely detailed historical checks Wrong app accepting web traffic, improper egress, improper permissions…. Not including liveness probes on pods Failing to specify encrypted storage Duplicating paths/names so traffic goes to the wrong service Running containers as privileged Setting up network connections to non-approved IPs / Internet Runaway resource usage because no limits were specified Failing to include proper labels required for traffic control Running Images from Unauthorized Registries
  • 15. Copyright ©2021 Styra, Inc. | All Rights Reserved Styra DAS: Push-button Authorization Controls for K8s 15 DESIRED STATE API Server RUNTIME STATE DESIRED STATE API Server RUNTIME STATE ... Open Policy Agent ● makes decisions locally and logs centrally ● flexible policy language ● vendor-neutral open-source (CNCF) Declarative Authorization Service OPA OPA Styra DAS ● OPA control plane ● 100+ Pre-built policies ● PCI, MITRE, PSP, CIS packs ● install in under 5 minutes ● multi-cluster policy authoring ● impact analysis Support all k8s flavors
  • 16. Copyright ©2021 Styra, Inc. | All Rights Reserved Terraform Challenges OPERATIONS SECURITY COMPLIANCE CICD well implemented, policy defined, protected against mistakes Prove what has been blocked/allowed over time. Easy reporting, extremely detailed historical checks Wrong app accepting web traffic, improper egress, improper permissions…. Failing to specify encrypted storage Duplicating paths/names so traffic goes to the wrong service Setting up network connections to non-approved IPs / Internet Runaway resource usage because no limits were specified Failing to include proper labels for chargeback Running unauthorized VM images
  • 17. Copyright ©2021 Styra, Inc. | All Rights Reserved Styra DAS: Authorization Controls for Terraform 17 Open Policy Agent ● makes decisions locally and logs centrally ● provides flexible policy language ● vendor-neutral open-source (CNCF) Declarative Authorization Service OPA Styra DAS ● policy assembly from multiple sources of truth ● distribution of policy to OPA ● audit log of decisions ● dry-runs policy changes Desired State Planned Changes terraform plan terraform apply
  • 18. Copyright ©2021 Styra, Inc. | All Rights Reserved Microservice Authorization Challenges Can Alice see the list of outgoing payments? 18 Service A Service B Service C Can service A ask for Alice’s profile on behalf of Alice? Can service A ask for Hooli’s outgoing payments on behalf of Alice? On every API call, every microservice makes an authorization decision Authz Implementation Challenges ● Different languages across services. ● Centralized service is too slow for microservices ● New services/teams should snap into framework ● Security/compliance should be able to audit policies ● Journey from coarse-grained permissions to fine-grained and from gateway enforcement to microservice enforcement
  • 19. Copyright ©2021 Styra, Inc. | All Rights Reserved Styra DAS: Authorization Sidecar Plus Control Plane 19 Service A Service B Service C Open Policy Agent ● makes decisions locally and logs centrally ● flexible policy language ● vendor-neutral open-source (CNCF) Declarative Authorization Service OPA OPA OPA Styra DAS ● OPA control plane ● distributes policies ● monitors OPAs ● team-based policy authoring ● impact analysis
  • 20. Copyright ©2021 Styra, Inc. | All Rights Reserved Creators of Open Policy Agent FAQ
  • 21. Copyright ©2021 Styra, Inc. | All Rights Reserved What does Policy-as-code mean and what does OPA provide? 21 Communicate Policies written in file format that people AND a policy engine understand. ● Precise ● Dry-runnable ● Portable Enforce Policy engine integrated into software and uses policies to make authorization decisions ● Fast ● Comprehensive ● Correct Audit Policy engine records all decisions and can be analyzed like any data ● Always-on ● Comprehensive ● Deep Govern Policy files have a lifecycle (approval, test, build, deploy) for governance. ● Manual & Automated ● Granular Policy-as-Code Approach to Authorization 21 OPA Provides .rego Policy file + Policy engine OPA Policy tools +
  • 22. Copyright ©2021 Styra, Inc. | All Rights Reserved How does OPA work? Service OP A Policy (Rego) Data (JSON) Request Policy Decision Policy Query Input can be ANY JSON value Output can be ANY JSON value OPA makes decisions. Service enforces decisions. Linux 22
  • 23. Copyright ©2021 Styra, Inc. | All Rights Reserved What does an OPA policy for Kubernetes look like? package kubernetes.admission deny[msg] { input.request.kind.kind == "Pod" some i image := input.request.object.spec.containers[i].image not startswith(image, "hooli.com/") msg := sprintf("image comes from bad registry: %v", [image]) } apiVersion: admission.k8s.io/v1beta1 kind: AdmissionReview request: kind: group: '' kind: Pod version: v1 namespace: opa object: metadata: labels: app: nginx name: nginx namespace: opa spec: containers: - image: nginx imagePullPolicy: Always name: nginx operation: CREATE JSON/YAML from Kubernetes OPA Policy: All images come from a trusted registry OPA Playground
  • 24. Copyright ©2021 Styra, Inc. | All Rights Reserved What does an OPA policy for Envoy look like? package envoy.authz # everyone can GET / allow { input.attributes.request.http.method == "GET" input.parsed_path = ["/"] } # updates to /v1/admin/{id} dependent on source IP allow { input.attributes.request.http.method == "PUT" input.parsed_path = ["v1", "admin", id] user_is_admin src := input.attributes.source.address.Address.SocketAddress.address net.cidr_contains("172.28.0.0/16", src) } user_is_admin { ... } parsed_path: [“api”, “v1”, “products”] attributes: source: address: Address: SocketAddress: address: "172.17.0.10" PortSpecifier: PortValue: 36472 destination: address: Address: SocketAddress: address: "172.17.0.17" PortSpecifier: PortValue: 9080 request: http: id: 13359530607844510314 method: GET headers: ... path: "/api/v1/products" host: "192.168.99.100:31380" protocol: "HTTP/1.1" JSON/YAML from Envoy OPA Policy: Allow all GET and some PUT OPA Playground
  • 25. Copyright ©2021 Styra, Inc. | All Rights Reserved Creators of Open Policy Agent Thanks!

Editor's Notes

  1. What each of OPA/DAS does to implement authorization.