ADadeptima·Mar 13, 2024
If you are looking for TLDR:
1. Define policies using declarative language Rego
2. Deploy OPA alongside your service as a sidecar in Kubernets
3. Make your service queries OPA when it needs to make policy decisions, passing the current state/context as input.
4. OPA evaluates the policies written in Rego against the input and returns a decision (allow or deny) back to your service.
Found it's hard to convince everyone around to use OPA/Rego and wrap into a managed service. The main objection - wrapping another DSL (domain-specific language) is hard.
However it was relatively simple to convince my team to use featured complete Go library Ladon https://github.com/ory/ladon
Ladon is inspired by AWS IAM Policies.
{
"description": "One policy to rule them all.",
"subjects": ["users:<peter|ken>", "users:maria", "groups:admins"],
"actio
Read the rest
ns" : ["delete", "<create|update>"],
"effect": "allow",
"resources": [
"resources:articles:<.*>",
"resources:printer"
],
"conditions": {
"remoteIP": {
"type": "CIDRCondition",
"options": {
"cidr": "192.168.0.1/16"
}
}
}
}
All policies are loaded on the app start, stored in memory (not DB) and checked with the help of small middleware which triggered the following function.
func (l *Ladon) DoPoliciesAllow(r *Request, policies []Policy) (err error)
https://github.com/ory/ladon/blob/972387f17e29c529ad3ff42a84...
Very negligible perfomance hit. Code is very simple, hackable, and can be subject for further optimisations.
Ladon is very fast. It's possible to run all user groups against all CRUD routes, and get the basic permission matrix or build some simple UI forms to test condition for better control.
P.s. Feel free to ping me in private @reactima (github, telegram) if you want to discuss the edge cases for the above.