OPA

About OPA

OPA is an open source, general-purpose policy engine that you can use to enforce versatile policies in a uniform way across your organization. Compared to a role-based access control (RBAC) authorization system, OPA allows you to create more fine-grained policies. For more information, see the OPA docs.

OPA policies are written in Rego. Based on the older query languages Prolog and Datalog, Rego extends support to more modern document models such as JSON.

Gloo Mesh's OPA integration populates an input document to use in your OPA policies. The structure of the input document depends on the context of the incoming request, described in the following table.

Before you begin

1. Complete the demo setup to install Gloo Mesh, Istio, and Bookinfo in your cluster.

2. Create the Gloo Mesh resources for this policy in the management and workload clusters.

   The following files are examples only for testing purposes. Your actual setup might vary. You can use the files as a reference for creating your own tests.

   • Management cluster
   • Workload cluster 1

   1. Download the following Gloo Mesh resources:

      • KubernetesCluster for cluster 1
      • KubernetesCluster for cluster 2
      • Workspace

   2. Apply the files to your management cluster.

      kubectl apply -f kubernetes-cluster_gloo-mesh_cluster-1.yaml --context ${MGMT_CONTEXT}
      kubectl apply -f kubernetes-cluster_gloo-mesh_cluster-2.yaml --context ${MGMT_CONTEXT}
      kubectl apply -f workspace_gloo-mesh_anything.yaml --context ${MGMT_CONTEXT}
      

   1. Download the following Gloo Mesh resources:

      • Virtual gateway
      • Workspace settings

   2. Apply the files to your workload cluster.

      kubectl apply -f virtual-gateway_bookinfo_north-south-gw.yaml --context ${REMOTE_CONTEXT1}
      kubectl apply -f workspace-settings_bookinfo_anything.yaml --context ${REMOTE_CONTEXT1}
      

3. Send a request to verify that you can reach the ratings app without authorization. By default Gloo Mesh allows any request on routes that do not specify authentication.

   curl -v ${INGRESS_GW_IP}/ratings/1 -H "Host: www.example.com"
   

   Example output:

   {"id":1,"ratings":{"Reviewer1":5,"Reviewer2":4}}
   

Configure an external auth policy with OPA

Create the external auth policy with OPA.

1. Create an OPA rego policy file.

   cat <<EOF > policy.rego
   package test
      
   default allow = false
   allow {
       startswith(input.http_request.path, "/ratings/2")
       input.http_request.method == "GET"
   }
   allow {
       input.http_request.path == "/ratings/3"
       any({input.http_request.method == "GET",
           input.http_request.method == "DELETE"
       })
   }
   EOF
   

   Review the following table to understand this configuration.

   Setting	Description
   default allow = false	Denies all requests by default.
   allow {...}	Allows requests that match two conditions as follows. 1) The path starts with /ratings/2 AND the HTTP method is GET; or, 2) the path is exactly /ratings/3 AND the HTTP method is either GET or DELETE.

2. Store the OPA policy in a Kubernetes config map in the workload cluster that you want to create the external auth policy in.

   kubectl --context ${REMOTE_CONTEXT1} -n bookinfo create configmap allow-get-users --from-file=policy.rego
   

3. Create an external auth server to use for your policy.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: admin.gloo.solo.io/v2
   kind: ExtAuthServer
   metadata:
     name: ext-auth-server
     namespace: bookinfo
   spec:
     destinationServer:
       ref:
         cluster: cluster-1
         name: ext-auth-service
         namespace: gloo-mesh
       port:
         name: http2
   EOF
   

4. Create a route table for the ratings app and external auth policy. Note that the route table selects the virtual gateway that you created before you began, and routes to the ratings service.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: networking.gloo.solo.io/v2
   kind: RouteTable
   metadata:
     name: bookinfo
     namespace: bookinfo
     labels:
       expose: "true"
   spec:
     hosts:
       - '*'
     virtualGateways:
       - name: north-south-gw
         namespace: bookinfo
         cluster: cluster-1
     workloadSelectors: []
     http:
       - name: ratings
         labels:
           opa: "true"
         matchers:
         - uri:
             prefix: /ratings
         forwardTo:
           destinations:
           - ref:
               name: ratings
               namespace: bookinfo
   EOF
   

5. Create an external auth policy that uses the OPA config map.

   kubectl --context ${REMOTE_CONTEXT1} apply -f - <<EOF
   apiVersion: security.policy.gloo.solo.io/v2
   kind: ExtAuthPolicy
   metadata:
     name: ratings-apikey
     namespace: bookinfo
   spec:
     applyToRoutes:
     - route:
         labels:
           opa: "true"
     config:
       server:
         name: ext-auth-server
         namespace: bookinfo
         cluster: cluster-1
       glooAuth:
         configs:
         - opaAuth:
             modules:
             - name: allow-get-users
               namespace: bookinfo
             query: "data.test.allow == true"
   EOF
      

Review the following table to understand this configuration. For more information, see the API reference.

Verify the external auth API key policy

1. Send a request to the ratings app along a path that is not allowed by the OPA policy, such as /ratings/1. Now, the request is blocked with a 403 response.

   curl -v ${INGRESS_GW_IP}/ratings/1 -H "Host: www.example.com"
   

2. Send the request again, this time along a path that is allowed by the OPA policy, such as GET /ratings/2.

   curl -v -X GET ${INGRESS_GW_IP}/ratings/2 -H "Host: www.example.com"
   

   You can reach the ratings app again!

   {"id":1,"ratings":{"Reviewer1":5,"Reviewer2":4}}