Stephan Renatus
27274e08b6
With this, we'll build our container images and binaries using golang 1.19.
Also, the go.mod version stanza is increased, letting us use go1.17+ features.
I had to run
go mod tidy -go=1.16 && go mod tidy -go=1.17
to get rid of `go mod tidy` related messages, and ran `go mod vendor`
afterwards.
* prometheus: adjust tests for new go1.19 metrics
Note that the new metrics only appear when using the Go runtime of 1.19. So,
we do the same we've done before when 1.17 brought in new metrics: add them
to the tests, and use build flags to not run the tests in the previous versions.
When the bump of github.com/prometheus/go_client to 1.13.0 was merged, it was
properly tested with all of 1.17 and 1.18. So, the previously expected metrics
should be there when using OPA from 1.17 or 1.18.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Open Policy Agent
Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
OPA is proud to be a graduated project in the Cloud Native Computing Foundation (CNCF) landscape. For details read the CNCF announcement.
Want to connect with the community or get support for OPA?
- Join the OPA Slack for day-to-day conversations with the OPA community.
- Need Support? Check out the Community Discussions to ask questions.
Join the OPA office hours
Every week at 10:00 PT / 19:00 CET
These sessions are open format for community members to ask questions. Use this time to get unblocked with your OPA deployments, learn more about the project, or to get more involved in the community.
Following each OPA release we will announce new features, the road map for the next release, and open the floor for community members to share what they're working on. Want to talk at one of these meetings simply add your topics to the meeting notes for the upcoming meeting.
Want to learn more about OPA?
- Go to openpolicyagent.org to get started with documentation and tutorials.
- Browse blog.openpolicyagent.org for news about OPA, community, policy and authorization.
- Try OPA with the Rego Playground to experiment with policies and share your work.
- View the OPA Roadmap to see a high-level snapshot of OPA features in-progress and planned.
- Check out the ADOPTERS.md file for a list of production adopters. Does your organization use OPA in production? Support the OPA project by submitting a PR to add your organization to the list with a short description of your OPA use cases!
Want to get OPA?
- Docker Hub for Docker images.
- GitHub releases for binary releases and changelogs.
Want to integrate OPA?
- See
to integrate OPA with services written in Go. - See REST API to integrate OPA with services written in other languages.
Want to contribute to OPA?
- Read the Contributing Guide to learn how to make your first contribution.
- Use #development in Slack to talk to other contributors and OPA maintainers.
- File a GitHub Issue to request features or report bugs.
How does OPA work?
OPA gives you a high-level declarative language to author and enforce policies across your stack.
With OPA, you define rules that govern how your system should behave. These rules exist to answer questions like:
- Can user X call operation Y on resource Z?
- What clusters should workload W be deployed to?
- What tags must be set on resource R before it's created?
You integrate services with OPA so that these kinds of policy decisions do not have to be hardcoded in your service. Services integrate with OPA by executing queries when policy decisions are needed.
When you query OPA for a policy decision, OPA evaluates the rules and data (which you give it) to produce an answer. The policy decision is sent back as the result of the query.
For example, in a simple API authorization use case:
- You write rules that allow (or deny) access to your service APIs.
- Your service queries OPA when it receives API requests.
- OPA returns allow (or deny) decisions to your service.
- Your service enforces the decisions by accepting or rejecting requests accordingly.
For concrete examples of how to integrate OPA with systems like Kubernetes, Terraform, Docker, SSH, and more, see openpolicyagent.org.
Presentations
- Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2022: video
- Open Policy Agent Intro @ KubeCon EU 2021: Video
- Using Open Policy Agent to Meet Evolving Policy Requirements @ KubeCon NA 2020: video
- Applying Policy Throughout The Application Lifecycle with Open Policy Agent @ CloudNativeCon 2019: video
- Open Policy Agent Introduction @ CloudNativeCon EU 2018: video, slides
- Rego Deep Dive @ CloudNativeCon EU 2018: video, slides
- How Netflix Is Solving Authorization Across Their Cloud @ CloudNativeCon US 2017: video, slides.
- Policy-based Resource Placement in Kubernetes Federation @ LinuxCon Beijing 2017: slides, screencast
- Enforcing Bespoke Policies In Kubernetes @ KubeCon US 2017: video, slides
- Istio's Mixer: Policy Enforcement with Custom Adapters @ CloudNativeCon US 2017: video, slides
Security Audit
A third party security audit was performed by Cure53, you can see the full report here
Reporting Security Vulnerabilities
Please report vulnerabilities by email to open-policy-agent-security. We will send a confirmation message to acknowledge that we have received the report and then we will send additional messages to follow up once the issue has been investigated.