Interservice Authorization in Avito.PaaS

on YouTube ↗42m

" summary

Describes implementing inter-service authorization in Avito.PaaS using Open Policy Agent (OPA) and Rego policies for over 2,000 services. Covers the engineering approach to deploy OPA-based authorization on a PaaS without breaking production or overwhelming developers with Rego policy authoring.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 3:18Authorization requirements
3. 6:30AAL configuration format
4. 11:27Envoy implementation
5. 17:08Open Policy Agent and Rego
6. 21:41Performance and caching
7. 25:14Deployment validation and security
8. 27:46Implementation results and conclusions
9. 29:13Q&A

" related talks

• 37mMake your security policy auditableNicolas Fränkel · Porto Tech Hub Conference 2024
• 25mMake Your Security Policy AuditableNicolas Fränkel · LambdaConf 2024
• 34mFine-grained Authorization in a Containerized WorldAsh Narkar · Open Source Summit + Embedded Linux Conference North America 2019
• 16mDistributed application level RBAC with OPAFederico Maggi · Conf42 Cloud Native 2022
• 14mA Policy-as-Code Approach to RBAC AuthorizationGraziano Casto · Conf42 DevSecOps 2024
• 42mDesign Patterns for OPA and Cloud Native AuthorizationTim Hinrichs · CloudOpen @ Open Source Summit North America 2022
• 32mOPA: So What Does the Policy Do?Jérôme Gauthier · Devoxx France 2023
• 56mDistributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy AgentGong Mengnan · Open Source Summit + Embedded Linux Conference + OSPOCon 2021