Authorization Policy with Open Policy Agent (OPA)?

[hongbo-miao]

Congrats shipping 2.11 ! 😃

After reading https://linkerd.io/2.11/features/server-policy/
I am wondering is there a way to use Open Policy Agent (OPA) for authorization policy, or Linkerd implemented its own way?

Thanks!

[adleong]

Linkerd has implemented policy its own way. I think any OPA integrations would probably either on the Gatekeeper side (i.e. controlling what kind of Linkerd Policy resources may or must be created) or perhaps some kind of controller which translates OPA policies into Linkerd policy primitives.

[olix0r]

We may revisit OPA integration as the feature evolves; but Linkerd's current implementation--establishing Server resources and binding ServerAuthorization resources to them--gives us a simple, declarative mechanism for efficiently enforcing mTLS-oriented access policies with the tools at hand. We wouldn't want to require additional OPA infrastructure in order to use Linkerd... We'd want it to be an additive extension to Linkerd's base functionality.

perhaps some kind of controller which translates OPA policies into Linkerd policy primitives

OPA uses rego to encode programs that take an object and (effectively) return a boolean. It wouldn't really be possible to translate this logic generally to map one of these programs to a set of resources. However...

I think any OPA integrations would probably either on the Gatekeeper side (i.e. controlling what kind of Linkerd Policy resources may or must be created)

I think there's a lot of fertile ground here. It would be great to use gatekeeper to enforce policies about what kinds of authorization is permitted.