Fine-Grained User Authorization for Kubernetes with OPA and LDAP
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 11:00· Concourse Hall 151 + Online·
summary
Yelp builds an OPA-based authorization system that replaces shared admin certs, tying human users to Okta/Active Directory JWTs and pulling team and service metadata from Git + AD into S3 bundles consumed by Open Policy Agent on each host. It enforces least-privilege for hundreds of teams across thousands of Kubernetes resources, adds mTLS and admin-key fallbacks, logs decisions to Splunk, rolls out via cluster-by-cluster dry-run, and ships ~2000 lines of Rego tests. Key elements: Open Policy Agent, Active Directory, my team keyword.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:52Mesos Migration to Kubernetes
- 3:38Motivation: Initial K8s access-controls
- 7:58Authorization Architecture Overview
- 8:26Authorization Component: OPA Capabilities, User Groups, Service Metadata
- 10:00Capability Example
- 11:12Authorization Component: The Policy Manager
- 11:31Authorization Component: Client side enforcement
- 12:11Example run: Basic
- 12:39Example run: team-based
- 14:25Rollout Strategy
- 15:31Challenges and Special Cases
- 19:32System Reliability
- 21:56Shortcomings and Future Improvements . Not every resource has meaning metadata labelsite.
- 24:03Conclusions
related talks
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
16mDistributed application level RBAC with OPA
34mFine-grained Authorization in a Containerized World
42mDesign Patterns for OPA and Cloud Native Authorization
09mSecure UI + Microservices within Kubernetes using OPA Authorization
40mHow Yelp Moved Security From the App to the Mesh with Envoy and OPA
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
56mDistributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy Agent