Skip to main content

4 posts tagged with "opcr"

View All Tags

· 4 min read
Roie Schwaber-Cohen

The Open Policy Agent (OPA) is a general-purpose decision engine used in a wide variety of contexts where policies govern authorization and access-control. One of the most important value propositions of OPA is that it decouples decision logic (defined in the policy) from decision enforcement (which happens in the application or service). This decoupling allows the policy to be developed and managed separately from the application or service. Decision-making execution is delegated to the OPA engine, guaranteeing that the policies are consistently interpreted and enforced.

OPA is used to enforce policies in many contexts, including microservices, Kubernetes, CI/CD pipelines, and API gateways. Having a single engine and language for handling authorization policies across the stack is a huge advantage for developers: it allows for policy reuse and makes testing, automation, and maintenance easier.

OPA policies are written in Rego and then bundled into a compressed tarball. The tarball is then loaded into the target environment, where the policy is enforced.

We believe that OPA’s distribution workflow could be enhanced and improved by integrating it with two Linux Foundation OSS projects: OCIv2 - the industry standard for container image formats, and Sigstore, an open and pluggable standard for code signing.

Three interconnected concerns need to be addressed as part of the policy-as-code workflow: versioning, signing, and sharing.

  • Versioning a policy makes it easier to maintain, share and discover
  • Signing a policy makes it possible to trust that the policy’s content is what the consumer of the policy expects it to be
  • Sharing and discoverability of policies promote reuse and reduce duplication of code and effort.

· One min read
Omri Gazitt
Eduardo Pedroso

The Open Policy Registry now has a proper console! Once you push policy images to the registry, you can view the policy repositories in your organization.

opcr repos

Clicking on a policy repository will show the tagged images you have for that repo.

opcr images

Let us know if you have any feedback!#

opcr

· One min read
Omri Gazitt
Vlad Iovanov

We wrote a quick tutorial for getting started with the policy CLI.

It takes about 5 minutes to complete, and you'll learn how to:

  • build and tag OPA containers
  • push and pull OPA containers from the opcr.io registry
  • sign and verify OPA containers with cosign
  • Run a read-eval-print loop, issuing queries to your OPA container

The full tutorial is here.

Happy hacking!#

opcr