Here's an example of a rego policy for OPA:
package envoy.authz
import input.attributes.request.http as http_request
default allow = false
token() = claimInfo{
token := split(http_request.headers.authorization, " ")
claims := io.jwt.decode(token[1])
claimInfo := claims[1]
checkRecord() = http.send({
"url": sprintf("http://localhost:8080%s", [http_request.path]),
"method": "GET",
"force_cache": true,
"force_cache_duration_seconds": 3600
})
allow {
requester_is_owner
}
allow {
method_is_post
}
method_is_post {
http_request.method == "POST"
}
requester_is_owner {
getRequest.body.username == tokenData.sub
}
The awesome thing about this is your app doesn't need to understand roles, users, etc. OPA requests a record from this app takes the JWT in the request and compares the owner of the record stored at username to the sub in the token. If they don't match you get a 403, if they do match it will return the record for you. The app just needs to return the record and doesn't care about auth.
You can also use OPA as a K8s admission controller to verify that resources have correct annotations, labels, policies, etc. It's a really awesome tool.
