Open Policy Agent (OPA) 入門

©2021 VMware, Inc.
Open Policy Agent (OPA) ⼊⾨
Motonori Shindo / motonori_shindo
VMware DevOps Meetup #7
2021/01/20

2
©2021 VMware, Inc.
1980年代の思い出

3
©2021 VMware, Inc.
What is Policy ?
何かしらによって課される制約に対して、どうある
べきかを規定するもの
• 法律、条例
• ビジネスルール
• アプリケーション要求
• 地域的制約
• セキュリティ的要件
• …
Photo by Scott Graham on Unsplash

4
©2021 VMware, Inc.
多くのシステムには個別にポリシーが存在している
Policy
Policy
Policy
Policy
Policy
Policy
Policy
Policy

5
©2021 VMware, Inc.
Open Policy Agent (OPA) とは
Domain Agnositc な Policy Engine
OPA は Policy Decision だけを⾏い、Policy
Enforcement には関与しない
Rego という Datalog Inspired な宣⾔的 Policy ⾔
語を持つ
オープンソース
利⽤⽅法
Library (Go）、REST API、Wasm
Source: https://www.openpolicyagent.org/docs/latest/

6
©2021 VMware, Inc.
Rego Primer by example
Network, Server, App Toplogies
{
"servers": [
{ "id": "web",
"proto": ["https", "ssh"],
"ports": ["p1", "p2"]},
{ "id": "app",
"proto": ["tomcat"],
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
{"id": "net1", "public": true},
{"id": "net2", "public": false}
],
"ports": [
{"id": "p1", "network": "net1"},
{"id": "p4", "network": "net2"}
]
}
JSON
web app db
p1 p2 p3 p4
Net1 (public)
Net2 (private)
https ssh tomcat mysql
Internet

7
©2021 VMware, Inc.
Rego Primer by example (1)
Complete Rules, Arrays, Logical AND, Assignments, Anonymous Variable, Packages
package example.rules
any_public_networks = true {
net := input.networks[_]
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
"any_public_networks": true
}
Policy Input
Output

8
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
Complete Rule:
<head> = <term> { <body> }
<body> が true であれば <head> = <term> になる。
”= true” は省略可能。

9
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
“input” は予約されたグローバル変数。

10
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
[ ] は配列を表す。‘_’ は無名変数。後に参
照する必要がなければ無名変数を使うこと
ができる。

11
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
<body> 中の複数⾏の <expression> は、Logical
AND として解釈される。”<express1> ;
<expression2>” と書いても同様。

12
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
”:=” は assginment（代⼊） operator。Rego の変数
は immutable なので、同じ変数に⼆度 ”:=” で代⼊す
ることはできない。

13
©2021 VMware, Inc.
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
}
Policy Input
Output
Package は Rego のルールに名前空間
を作り出す。Data API で呼び出される
場合も、この名前空間が使われる。

14
©2021 VMware, Inc.
Partial Rules
public_network[net.id] {
net.public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
"public_network": [
"net1"
]
}
Policy Input
Output
<head> が [ ] を持っている場合は、Partial
Rule と呼ばれ、複数の値をセットするのに
使われる。

15
©2021 VMware, Inc.
Logical OR
shell_accessible[server.id] {
server := input.servers[_]
server.proto[_] == "telnet"
}
shell_accessible[server.id] {
server := input.servers[_]
server.proto[_] == "ssh"
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
"shell_accessible": [
"web"
]
}
Policy Input
Output
同じ <head> を持つルールが複数ある場合
は、それらは Logical OR と解釈される。

16
©2021 VMware, Inc.
Iterations
public_ports[id] {
some i, j
id := input.ports[i].id
input.ports[i].network == input.networks[j].id
input.networks[j].public
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
"public_ports": [
"p1"
]
}
Policy Input
Output
Rego では <expression> に “some” で宣⾔
した変数を埋め込むことで暗黙的にループ
が形成される

18
©2021 VMware, Inc.
クイズ
Public な network に接続されている port を持っている server のリストを取得
public_servers[server] {
some i, j, k
input.servers[i].ports[_] == input.ports[j].id
input.networks[k].id == input.ports[j].network
input.networks[k].public
server := input.servers[i].id
}
{
"servers": [
{ "id": "web",
"ports": ["p1", "p2"]},
{ "id": "app",
"ports": ["p3"]},
{ "id": "db",
"proto": ["mysql"],
"ports": ["p4"]}
],
"networks": [
],
"ports": [
]
}
{
"public_servers": [
"web"
]
}
Policy Input
Output
??? 回答は後⽇ Tweet します。

19
©2021 VMware, Inc.
Built-in Functions
https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions
Comparisons
• ==, !=, <, <=, >, >=
Numbers
• +, -, *, /, %, round(), abs(), etc.
Aggregates
• count(), sum(), max(), min(), product(), sort(), etc.
Arrays
• concat(), slice()
Set
• get(), remove(), union(), filter(), etc.
Strings
• concat(), contains(), startwith(), endswith(), etc.
Regex / Glob
• match(), is_valid(), split(), find_n(), etc.
Glob
• match(), quote_meta()
Bitwise
• or(), and(), negate(), xor(), lsh(), rsh()
Conversions
• to_number()
Types
• is_number(), is_string(), is_boolean(), etc.
Encoding
• encode(), decode(), marshal(), unmarshal(), etc.

20
©2021 VMware, Inc.
Built-in Functions (cont’d)
https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions
Token Signing
• encode_sign_raw(), encode_sign()
Token Verification
• verify_rs256(), verify_rs384(), etc.
Time
• date(), clock(), weekday(), add_date(), etc.
Cryptography
• md5(), sha1(), sha256(), parse_certficates(), etc.
Graphs
• walk(), reachable()
HTTP
• send()
Net
• cidr_contain(), cidr_intersects(), etc.
UUID
• rfc4122()
Semantic Versions
• is_valid(), compare()
Rego
• parse_module()
OPA
• runtime()
Debug
• trace()

21
©2021 VMware, Inc.
Rego Playground
https://play.openpolicyagent.org/

22
©2021 VMware, Inc.
OPA Ecosystem

23
©2021 VMware, Inc.
Kubernetes Integration - Gatekeeper
Kubernetes API
Server と OPA の
間のブリッジとして
動作
API Server が
Gatekeeper の
Webhook をトリ
ガー
課したい制約を
Rego で記述
Source: https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/

24
©2021 VMware, Inc.
Policy Template and Policy Instance CRD
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: k8srequiredlabels
spec:
crd:
spec:
names:
kind: K8sRequiredLabels
validation:
# Schema for the `parameters` field
openAPIV3Schema:
properties:
labels:
type: array
items: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequiredlabels
violation[{"msg": msg, "details": {"missing_labels": missing}}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_]}
missing := required - provided
count(missing) > 0
msg := sprintf("you must provide labels: %v", [missing])
}
apiVersion:
constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: ns-must-have-gk
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Namespace"]
parameters:
labels: ["gatekeeper"]

25
©2021 VMware, Inc.
Gatekeeper Policy Library
https://github.com/open-policy-agent/gatekeeper-library/tree/master/library
General
• allowedrepos
• block-noodepoort-services
• containerlimits
• containerresouorceratios
• externalip
• httpsonly
• imagedigests
• requiredlabel
• uniqingresshost
• uniqueserviceselector
Pod Security Policy
• allow-privilege-escalatiion
• apparmor
• capability
• flexvolume-drivers
• forbidden-sysctls
• fsgroup
• host-filesystem
• host-namespace
• host-network-ports
• privileged-containers
• proc-mount
• read-only-root-filesystem
• seccomp
• selinux
• users
• volumes

36
©2021 VMware, Inc.
問題点
• ClusterIP と spec.externalIPs フィールドを触
れる⼈は、⾃由にトラフィックをステアリング
できる
回避⽅法
• OPA で Service の spec.exterrnalIPs と
spec.loadBalancerIP を許可した IP アドレス
のみ許可するポリシーを適⽤する
CVE-2021-8554 を TMC/OPA で回避する
https://tanzu.vmware.com/content/blog/tutorial-vmware-tanzu-mission-control-
kubernetes-vulnerability-cve-2021-8554

40
©2021 VMware, Inc.
Open Policy Agent 本家のサイト
• https://www.openpolicyagent.org/
• https://github.com/open-policy-agent
Tanzu Mission Control で学ぶ Open Policy Agent Part 1 〜 4 by 星野さん
• https://blog.lespaulstudioplus.info/posts/tmc-demanabu-opa/
OPA Deep Dive, Kubecon NA 2019
• https://www.youtube.com/watch?v=Uj2N9S58GLU
TGIK 119 Gatekeeper and OPA
• https://www.youtube.com/watch?v=ZJgaGJm9NJE
Styra
• https://www.styra.com/
• https://academy.styra.com/
References

Open Policy Agent (OPA) 入門

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Open Policy Agent (OPA) 入門

Ähnlich wie Open Policy Agent (OPA) 入門 (20)

Mehr von Motonori Shindo

Mehr von Motonori Shindo (19)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Open Policy Agent (OPA) 入門