Lightning Talk: How We Use Istio and OPA for Authorization
summary
HP's FitStation runs 20+ micro-services in Go on Kubernetes with Istio enabled and splits services into three layers: L1 uses a custom Istio mixer adapter that calls a centralized RBAC service to allow or deny API access, L2 embeds a client library that queries Open Policy Agent (OPA) with JSON-packed user, API and request attributes so policies plus user→company data enforce per-company, per-resource rules, and L3 relies on Kubernetes network policies. The setup is implemented and in use.
AI-written summary · about
chapters (4)
related talks
05mLightning Talk: How We Use Istio and OPA for Authorization
56mDistributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy Agent
07mLightning Talk: Running Arbitrary Code Safely with Istio
13mLightning Talk: Enhancing Security with Istio: Realtime JWT Access Revocation
16mDistributed application level RBAC with OPA
09mSecure UI + Microservices within Kubernetes using OPA Authorization
05mLightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) Policies
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster