About
Enforce Open Policy Agent (OPA) policies for more fine-grained access control.
About OPA
OPA is an open source, general-purpose policy engine that you can use to enforce versatile policies in a uniform way across your organization. Compared to a role-based access control (RBAC) authorization system, OPA allows you to create more fine-grained policies. For more information, see the OPA docs.
OPA policies are written in Rego. Based on the older query languages Prolog and Datalog, Rego extends support to more modern document models such as JSON. For an overview of OPA, review the following video.
OPA input structure
Gloo Mesh Gateway’s OPA integration populates an input document to use in your OPA policies. The structure of the input document depends on the context of the incoming request, described in the following table. For more information about input documents, see the OPA docs.
| OPA input structure | Description |
|---|---|
input.check_request | By default, all OPA policies contain an Envoy Auth Service CheckRequest. This object has all the information that Envoy gathers about the request being processed. You can view the structure of this object in the attributes section of the linked Envoy doc. |
input.http_request | When processing an HTTP request, Envoy populates this field for convenience. For the structure of this object, see the Envoy HttpRequest docs and proto files. |
input.state.jwt | If you use OAuth, the token retrieved during the OIDC flow is placed into this field. |
OPA with other types of external auth
The OPA external auth module can be combined with other external auth modules, such as API keys, to perform additional validation checks on incoming requests. To find an example of how to use API keys and OPA together, see API key and OPA.
The following video shows an example of using OAuth and OPA.
OPA implementation options
Gloo’s external auth service supports three main ways to implement OPA. You can also use a mix of implementations in the same cluster. Just be sure to create separate external auth policies for each implementation.
For quick testing or small OPA use cases, you can load the Rego rules from a Kubernetes config map as OPA module. You create your Rego rules as Kubernetes config maps in the cluster. Then, you use an external auth policy to tell the Gloo external auth service to load these rules via the OPA module. This approach can be convenient, especially if you are not familiar with administering an OPA server and do not need extended capabilities such as bundling.