srenatus

$ docker run -it --platform linux/arm64  docker.io/openpolicyagent/opa:edge eval --timeout 1s -t wasm 'numbers.range(1,1e10)'
Unable to find image 'openpolicyagent/opa:edge' locally
edge: Pulling from openpolicyagent/opa
dbcab61d5a5a: Already exists
1867b2187888: Already exists
4d704a88b82e: Already exists
db698d0a411a: Pull complete
Digest: sha256:ae185c082e080644c9e4089c688bca39c3ab9ae7b6eb5b546d1daf6982cee238
Status: Downloaded newer image for openpolicyagent/opa:edge
WARNING: image with reference openpolicyagent/opa was found but does not match the specified platform: wanted linux/arm64, actual: linux/amd64

srenatus

import { Set, size, fromList } from "set"
import { length } from "string"

enum Value {
  NumberValue(Number),
  StringValue(String),
  SetValue(Set<Value>),
}

let length = (x) => {

srenatus

admin:
  access_log_path: /dev/stdout
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }

static_resources:
  listeners:
  - name: listener1
    address:
      socket_address: { address: 0.0.0.0, port_value: 51051 }

srenatus

OPA, oso, oh no!

• Caveat
• Maturity
• Interface
  • WebAssembly
• Policy language
• Next Steps

You may have gotten accustomed to Keep Calm and Use OPA, and then suddenly, there's

srenatus

require 'oso'
$polar=<<POLAR
add(x: String, y: String, x.concat(y));
add(x: List,   y: List,   x.concat(y));
add(x: List,   y: String, x0.concat(y)) if x0 in x;
add(x: String, y: List,   x.concat(y0)) if y0 in y;
POLAR
class Example
  def initialize
    @o = Oso.new

srenatus

plugins:
  envoy_ext_authz_grpc:
    addr: :9191
    path: foo/bar # always true
    enable-reflection: true
decision_logs:
  console: true

srenatus

source 'https://rubygems.org'
gem 'pry'
gem 'hashie'
gem 'oso-oso'

srenatus

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sample-api-grpc
  name: sample-api-grpc
  namespace: default
spec:
  selector:
    matchLabels:

srenatus

/*
 *
 * Copyright 2015 gRPC authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *

srenatus

+-----------+--------------------------------------------------------------------------------------------+
| Query 1   | data.partial.authz_v2.authorized                                                           |
+-----------+--------------------------------------------------------------------------------------------+
| Support 1 | package partial                                                                            |
|           |                                                                                            |
|           | __not1_1__ {                                                                               |
|           |   "iam:roles:owner" = input.resource                                                       |
|           |   "iam:roles:update" = input.action                                                        |
|           |   _ = input.subjects[_]                                                                    |
|           | }