OPA for HASHICORP VAULT POLICY

[saigopi]

Hi All,

I am currently using HASHICORP Sentinel to validate the policy in HashiCorp Vault.

But we do have Openshift, Terraform and other eco system hence going to explore with OPA.

I do see there are direct links for terraform, kubernetes, envoy etc.
https://www.openpolicyagent.org/docs/latest/ecosystem/

We planned to start with HashiCorp Vault, to replace the Sentinel.

Does is possible to write OPA policy for HashiCorp Vault.

[charlieegan3]

Hey @saigopi. It's great to hear that you're considering using OPA for platform-wide policy. I think it could be a good fit but would need to know more about your use case.

Do you have any examples of a policy you'd like to enforce within Hashicorp vault? If you are configuring vault with Terraform, then there are some options there to control the vault configuration for example.

[saigopi]

HI Egan,

Thank you for response here.

we can take the example use case from sentinel itself.

Please refer the below two links.
https://developer.hashicorp.com/vault/tutorials/policies/sentinel-validation-policies
and
https://developer.hashicorp.com/vault/tutorials/policies/sentinel

[charlieegan3]

Ahh I see. I wasn't familiar with this functionality in Vault since it's an enterprise feature.

I think that you will still have to use Sentinel since it's natively integrated with Vault. However, you might be able to re-write you sentinel policies to point to an OPA instance using the http functionality in sentinel. https://docs.hashicorp.com/sentinel/imports/http. They have an example here: https://developer.hashicorp.com/vault/tutorials/policies/sentinel-http-import#step-4-write-sentinel-egp

The OPA endpoint you'd likely want to use is in the data API, documented here: https://www.openpolicyagent.org/docs/latest/rest-api/#get-a-document-webhook. This allows you to post data and get a custom response which could be used in sentinel to make the decision.

I suppose in an ideal world you'd like to be able to stop using Sentinel completely though. I can't see a way to do that. What my proposal would give you though is the option of managing all policy in the OPA deployment for vault and other services too, which might be more important.

Do you think that could work?

[saigopi]

Hi Egan,

Thank you for sharing this details.