Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2018 (Shanghai), 26 Nov 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Intro: Open Policy Agent - Torin Sandall, Styra

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Intro: Open Policy Agent - Torin Sandall, Styra

OPA is designed and implemented to integrate with a wide range of services, frameworks, and protocols. Today there are integrations with a number of different projects like Kubernetes, Spring, and PAM as well as protocols like HTTP, gRPC, and Thrift. This session will introduce new users to OPA and explain how you can integrate OPA into your apps. The session will focus on the APIs that you need to use to offload policy decisions to OPA. During the session we will walk step-by-step through the process of integrating a sample app with OPA. The session will also cover best practices to follow when integrating with OPA. Attendees can expect to leave with a strong understanding of how to integrate with OPA. We will try to make the session as interactive as possible so that people can ask questions during the step-by-step walkthrough.

To learn more click here: https://sched.co/FuLE

A

So this is an intro session talking about the open policy agent, just like a little show of hands. How many people here have heard of the open policy agent before coming to this conference?

A

One two: three: okay, so this is totally new for most people. So that's that's fine! What I'm gonna do today is talk a little bit about where the project started and explain the core features that you get when you use OPA and then I'm gonna show how to integrate a service with OPA as well.

A

So we started the project at a company called steerer where I work in early 2016 and the goal was to basically create a reusable building block that you could use to enforce policies across a wide range of Technology over the last year, or so we've seen a lot of growth in terms of the number of people that are using OPA or the open policy agent.

A

One example of a company, that's using OPA, is Netflix, so they were one of the earliest adopters of the project and they use OPA to enforce authorization in a highly distributed environment.

A

So they have hundreds or thousands of micro services that are written in all kinds of different languages that have different identity systems that execute different ends of environments and they need to enforce rules to control who can access those services internally at the company and so today, they're using open to enforce API authorization policies over HTTP and G RPC ap is they're also using open to enforce authorization policies over Kafka. So they have certain topics in Kafka that have a very high fan-out.

A

What that means is that a right into Kafka gets seen by a large number of consumer services, it's very expensive if a bad right happens because they have to go and recover the system, so they use open to protect the system from Bad Rights, and so today, it's being it's integrated into their security platform and it's used across a number of different teams and Netflix Medallia is another company using OPA. They have a completely different use case, though they use open to an invariants over their infrastructure and their platform.

A

So, for example, they use it with terraform for risk management. If you've ever worked with terraform you'll know that a very small change in a terraform file can have a huge impact on your infrastructure. You can bring down a scaling group. You could bring down a you know, a network service, so you have to be very careful when you're changing terraform files. What value does is they basically have a policy? They have a set of policies that compute a risk score for changes to terraform.

A

So the terraform plan that contains add and remove operations is provided as input to OPA and then OPA evaluates the policies and calculates a score or a number that represents how risky those changes are and then what they do.

A

Is they compare that number to the budget that the person making the change has so, like a junior engineer, has a very low risk budget, but a senior or a principal engineer has you know a high or infinite risk budget they're also using open to audit their AWS network security group security, posture and other other infrastructure concerns that they have chef?

A

Is another company using OPA again, their use case is completely different, so they use open to enforce or to enable authorization over end-users of one of their products with OPA, so they they basically pass all the incoming requests into their product to open. They ask: should this request be allowed or denied so for them hope is useful because it helps them get to market quicker. They don't have to roll this authorization system from scratch and they're, also using OPA to answer audit questions like you know which users have access to which resources in the system.

A

So this is just three examples of companies using OPA but even sort of public about it, but we have others there. Companies like CloudFlare Intuit, Pinterest, State Street, which is a massive Bank in the North America SolarWinds Cisco, and more all using open to enforce a variety of different policies across different technology.

A

The project itself is part of the cloud native compute foundation. We joined as a sandbox tier project earlier this year and we're really excited to be part of the CN CF, and we've been seeing a lot of growth in the project over the past year or so as well. So today we have about 36. Different people have contributed to the project we have over close to 400 people on slack today that are asking questions, answering questions for other people, talking about use cases and so on.

A

We see 25,000 container downloads a week for the project and we have over 20 integrations with open source projects in the ecosystem. So what? What is? What is the open policy agent? What is Opa Opa is a general-purpose policy engine, and so what that means is that you can take OPA and you can use it to help enforce policies in any service in any system at any layer of the stack. So when you're using open what you're doing is you're decoupling policy decision-making from policy enforcement.

A

So, for example, if you have a service and it receives an API request, it might need to decide whether to allow or deny that request, and so the way this works is that when the service receives a request, it executes a query against open says: should this request be allowed?

A

Opa takes the policies and the data that it has access to it, computes a decision like a lower deny, which it sends back to the service to be enforced, so when using open your decoupling policy decision-making from policy enforcement. So, for example, if you have a service that serves salary data, when a request comes in to say, get Bob salary from Alice, the salary service will query OPA and when it does that it'll provide certain inputs.

A

It'll provide attributes that describe the request, that's taking place so they'll provide things like the method and the path and the user. That's executing that API request. In this case the user is considered the authenticated user. So OPA is not helping. You solve authentication, it's helping, you solve authorization who can do what and so that open would evaluate this, and then it would produce a decision like true or false to represent. Allow deny that ultimately get sent back to the salary service to be enforced.

A

Now it's important to keep in mind here that the service can refer to a number of different types of components in the system, so we could refer to an internal micro service that you've built it could refer to the API gateway. That's terminating, you know, traffic from your customers. It could refer to a message broker. It could refer to the kubernetes api server or it could just be a script in your CI CD pipeline.

A

So this is why we call open general purpose because you can use it across all of these different parts of your system now, in order to make that happen, we've made certain decisions with how opens design, and so one of those decisions is that OPA is not coupled to any domain specific model or any project specific model. So when you execute a query against OPA, you can actually supply arbitrary JSON data. As in so you can provide strings, arrays numbers or deeply nested objects. Now, oppa doesn't understand what those things mean.

A

That's what your policies have to do. They have to apply meaning to that input, but on its own opens not coupled to that to that those data models at all and then similarly, the decisions that open generates can also be arbitrary, JSON data.

A

So you can have like a true or false decision for a simple API authorization policy, or you know you might generate a list of servers where a workload has to be placed, or you know the set of violations that have occurred in the system now, when you're using open once you do that through, like one-time integration effort, what you find yourself doing mostly, is writing policy writing rules that govern how the system should behave and so to do that.

A

Oppan provides a purpose-built, declarative language that we call Rago and Rago is basically designed and built from scratch to help you codify policies over this arbitrary kind of JSON data. So it's really good at helping answer questions like can this user do this operation on this resource or you know which invariants are violated by this workload when it's created in kubernetes or we know which users can SSH into production hosts so opus, very, very good or the language is very, very good at helping you write down logic that express constraints over the system.

A

Now, when you actually go to integrate with OPA, you have different options, but they're all kind of the same, so whether you're going with a library, integration or a sidecar integration or a host level daemon integration, the model is basically the same and the way that we think of OPA is sort of as this host local cache for policy decisions so opens as close to the service as possible, and the reason for that is twofold.

A

So, first of all, you want to minimize the amount of latency that you introduce into the request path in order to make the policy decision in a high frequency, low latency use case, like micro service, API authorization, you can't pay a network hop every time you have to decide whether a request should be allowed right. The second reason is availability. If every time your service has to make a decision, it's got a call-out across the network. Then, if the network goes down or the host that opens running on goes down, you're gonna have an error.

A

Come back to your service and you're not able to serve traffic right, you're gonna have downtime, and you don't so we think of oppa as this host local cash, and we recommend that you run it as close to the service as possible, ideally on the same host now. In order to make that happen, we've made certain decide decisions in oppa, so the first design decision is that all the policy and data that oppa uses to make decisions- all of that is kept in memory.

A

Okay, so there's no external database that opens connecting to in order to get policies from we found. This is really valuable, because every time someone takes oppa and uses it, they already have some place where they want to store policies that they want to treat as the source of truth for the policies. In the context, we don't want to add yet another source of truth into the system or other source of persistence into the system with oppa.

A

The second thing is that when oppa makes decisions, it's not going to call out to any external systems. Okay, all of the policy and data that open needs to make a decision is stored in memory in the agent. Now you can take oppa and you can extend it to call out to other systems. We have built-in functions in the language that allow you to do things like execute an HTTP request, but on its own oppa is not going to do that. It's all host local. Now.

A

That begs the question: well, where are the policies and the data come from, and so the answer to that is that we have a set of API. Is that you can implement to control and monitor the oppa's? So, for example, we have a bundle service API that you can use to send policy and data down to the oppa. We have a status service API that you can use to receive status updates from the oppa. So you can monitor them.

A

You can know what version of the policy they're running with whether there are any errors trying to activate the most recent version of the bundle and so on, and then we also have this log service API for receiving an audit log of all the decisions that opens made over the last period of time, and so this is very useful when you need to audit what policy decisions have been made or when you need to debug the policy decisions are being made in the system, because now you have this, what you can do that centrally and then, in addition to the management API, is we also have a set of tooling that you can use to build test and debug your policies?

A

So we have an interactive shell or read eval print loop. That allows you to experiment with policies like command line. We have a test framework, so you can codify that your policies are actually correct. We have things to help. You format, your code, execute dependency, analysis, static analysis and the policies do semantic checks and so on. We also have a VSO visual studio code extension, which is really nice, because it's very you can kind of visually select policies and evaluate them and see what they return.

A

It's really useful when you're, when you're, building up policies to be able to see very quickly what the policies are generating and then we also have more advanced features like tracing that. Tell you exactly why a decision was made the way it was made and then, in addition to all of that tooling and core kind of language features, we also have a number of integrations with different projects in the ecosystem.

A

So, as you can see, these are kind of across the stack, but one very common use case for OPA is this problem of admission control so in Mission Control, if you're not familiar with it, is this problem where you know anytime, you create a resource in a kubernetes cluster. You need to decide whether that resource should be created, and this is much more fine-grained than just regular authorization. So admission control sees the full extent of the resources that are being created right. It sees the images that are being specified in containers.

A

It sees the host names that are contained in ingres objects and so on right now, what we're seeing a lot is that there are all these organizations adopting kubernetes but typically there's a team in these organizations.

A

That's responsible for operating kubernetes, and this applies whether you're talking about on pram or hybrid or a managed version of kubernetes there's, usually some team, that's responsible for making sure that the workloads and the services, and so on, they're deployed on top are well-behaved and following like the the policy that the organization is set forth and so OPA helps them enforce those kinds of policies.

A

We also have a bunch of integrations with different service and sort of application level. Networking projects like envoy and sto and Kong and spring security, and so the nice thing about these is that you can basically started forcing access, control or API authorization over your services without writing any code for those services you just as long as you're running on top of one of those platforms, you can basically start applying OPA policies to them now these are all fairly high level, but we also have a like a Linux Pam integration.

A

So Pam is this: it's the system for controlling access to things like SSH and sudo at the host level, and so we have one user of OPA that restricts SSH access based on an interesting policy. What they do is they say that developers can SSH into hosts if they have a certificate for an application that has an open ticket at that time, and so otherwise they can't for an application running on that machine with an open ticket.

A

It's a very fine-grained context-aware example of policy that people are using over to enforce and then in addition recently, we've started integrating with a bunch of different projects in the data storage space, so we have integrations with SEF Minaya Kafka, a sequel, light and elastic search, and the idea there is that people are using okhla to enforce fine-grained policies over who can see what and what who can access sensitive data in the system?

A

Okay. So how does OPA actually work to explain how open actually works, I'm going to kind of step through and give this example policy that says that employees are allowed to read their own salary as well as the salary of anybody they manage in this in the salary service. Now in English, this policy sort of has two parts to it.

A

There's sort of two statements here so the first statement says employees can read their own salary and the second statement says that they can read the salary of anyone they manage, and so what we're gonna do is we're gonna implement two rules in OPA to enforce this policy now, in order to implement those rules, we need some input, data that we can reason about, and so what we're gonna do is start with this input data that says the method is get and the path is the array, salary, Bob and the user is Bob, so the user is the authenticated user, making the request we've already done authentication.

A

Now we want to authorize and we're representing the path as an array, we'll see why in a second, so this is the first rule that we're gonna use. This is going to implement the first statement, and the way you can understand this rule is allow is true. If input method matches get and input path, matches, salary, employee, ID and input user matches employee ID.

A

Now the interesting thing about this rule is the second and third expressions in the body of the rule. The input path, matches, salary and input user matches. Employee ID, what's interesting about those expressions, is that employee ID is a variable and when oppa evaluates this rule, it's gonna bind that variable to the same value in all of the expressions.

A

So in this case, when oppa evaluates the rule, employee ID is going to be bound to Bob, and so, if you just sort of step through this in your head, you'll see that well, employee input method equals get an input path, equals salary, Bob an input user equals Bob.

A

So all of the expressions in the body of the rule are true. So if the service asked for the value of allow, it would get true back and it would just allow the request right and that's what we want. That's the first part of this policy now suppose a different user asked for Bob salary.

A

So now Alice is asking for Bob's salary. What's going to happen well, in this case, the same thing is gonna happen. It's gonna go and evaluate, and employee IDs gonna be bound to Bob, but the last expression is no longer true right. Input.

A

User does not equal Bob, and so we say that that expression is going to fail, and so if the service was asking for allow Oprah would not be able to find a way to prove that allow should be equal to true, because one of the expressions in the body is false, so in this case the request would be denied, but suppose that that's actually Bob's manager.

A

So in order to implement the second part of the policy, what we're gonna do is make use of some context. So on the bottom left, you can see a little data structure there and just imagine that that data somehow got loaded into oppa and now it's cached in memory in oppa.

A

So now we have a notion of who manages who- and we can extend the policy to use that so we're gonna add a second rule to deal with the second part of the policy and that rule looks very similar, you'll notice on the top I've added an import line. That's just aliasing the the manager's data for below. So the second rule says: allow is true if input method matches get an input, path matches salary, employee, ID, but now the third expression is a little bit different.

A

It says input user must match managers, employee ID underscore so what's interesting about this rule is that well, employee, IDs gonna get evaluated the same way. It's gonna get bound to Bob, but that underscore is special. What that underscore does? Is it tell oppan to search the array referred to by data managers Bob for a value that makes the body true so what's gonna happen? Is that opens gonna search over that array and it's gonna find Alice and again, if you look at the rule, you'll see that method is get and path.

A

The salary, Bob and input user is Alice, and so this time Oprah would be able to generate the value true for allow. So the expressions and the bodies of the rules are ANDed together and then you can create multiple rules to express like logical or disjunction. Okay.

A

So, if you're interested in more details about how open works, how the language works check out the website open policy agent org, we have a bunch of documentation on there. That goes into detail about the different constructs available to you as a policy author, so check out how do I write policies that explains the language in detail. If you find yourself writing actual policies, take a look at the language reference that has a detailed got our list of all the built in functions in the language.

A

So if you need to do things like use, regular expressions or you need to parse, you know JSON web tokens or you need to parse x.509 certificates and so on. We have built-in functions that are part of OPA that help you do that and then finally, we also have tutorials. If you just want to kick the tires and try it out. We have tutorials for things like HTTP, API authorization, kubernetes, admission control, Kafka, SSH and so on.

A

Okay, so now I want to talk about how you can actually integrate with OPA. So there are sort of three different ways that you can write integrations with ova. The simplest way is just to run OPA on the command line, so OPA has a as a sub command called eval. That allows you to provide a query and then it'll, basically print the result of that query to standard out, and so this is really useful.

A

If you just want to enforce policies in like a C ICD pipeline right, you get the OPA binary, you run it and you just check the output. If you want, you can also check you can make it fail. You can better that you make it exit with a non zero status code in certain cases, but it's pretty easy to talk about up.

A

The second way of integrating OPA is with is via HTTP, so this allows you to basically integrate oppa in any language in any framework in any in a runtime right. You just execute a single HTTP POST against oppa. You can specify the name of the policy or you can just leave that out and then you provide arbitrary JSON data as input, and you get a decision out in order to do that, you obviously have to run oppa as a daemon or as a sidecar, and when you do that, you want to take security into account.

A

You want to make sure that you know not. Just anybody can access the open, API and change things so consider using a UNIX domain socket or if you run it over TCP, then use TLS with authentication and authorization enabled, and then the third way of integrating with oppa is by embedding it as a library and so I I like this approach a lot because the open itself, the code base, is fairly lightweight.

A

There are very few dependencies and the API that it gives you I, think is fairly simple, but it exposes basically all of the functionality that you get with oppa. So it's nice, because there's no extra deployment steps right. You don't have to worry about running. You know a new daemon say on every machine or adding it as a sidecar to all your container, all your pods in kubernetes, it's very easy to get up and running.

A

So this is what HelloWorld with oppa as a library looks like. So the first thing you need to do is you have to import this github comm, slash, open policy agent, slash oppa, / Rago package and then once you've done that you can start evaluating queries, and so the first thing you have to do is construct a Rago object, and here we're just passing in a single query that says that you know a must be one and then once you've constructed the Rago object, you can evaluate it.

A

When you run evaluation, you have to provide a go context.

A

That's important because, as I mentioned before, it's possible for you to extend OPA to call out to an external system during evaluation if you need to, and so that's important to propagate the context there, but it's also useful if you need to cancel evaluation, because it's maybe taking too long in an API authorization use case, that's not user.

A

The case open waits very quickly on the order of you know: 50 microseconds or 100 microseconds, but if you have policies that are doing a large search over you know, contextual data, then that that's query can take a little while and you you might want to be able to cancel it. And so then, once you get the answer back, the result said or RS here. You just have to interpret that, and so here we're checking if there's an error, otherwise we're printing the result.

A

Now the output that open gives you it's kind of interesting. So here we have a single result and in each result, in a set there are going to be two things that you get so the first thing is this set. Is that are the values of the expressions in the query? So in this case we just know that a equals one is true, because it's trivial, we also get the variable bindings, though so this tells you like, in this case a was bound to one went oppa valuated that query okay.

A

Let's look at a slightly more interesting example, so here we've taken the first rule from before, and we've just stuffed that into a query that says you know, input method must be get path, must be salary, employee, ID and input user must be employee ID, but now we're also supplying input when we run evaluation and so I've just created a map literal here that we saw before we run evaluation and we can see now. The output has three expression values in it.

A

It's saying that all of the expressions are true, but employee ID was bound to Bob. Okay, if we have a different user, say Alice was was provided in the input, then in this case, there's no way for open to prove that these expressions could be satisfied and so the empty or the result set would be empty.

A

So, let's look at how you but okay, so the thing is like this is you know: we've only shown a query and some input here. You don't want to try to encode your entire policy into a single query.

A

That would be very, very painful, and so what we're gonna do is basically start providing other things, so we're gonna basically define our policy from before in a string we call those strings modules and we're also going to define some context here, we're going to instantiate oppa's in memory storage, providing the manager list and then we're gonna go and construct the regular object, and so this time we're supplying 4/4 inputs to the Rago object, we're providing the module the policy we're providing the the storage we're providing the query this time it doesn't have any variables in it.

A

It says assert that example dot. Allow is equal to true and then we're providing some input rather the same implement as before, and so the result here there are no variables, so the variable binding list is empty, but the one expression in it happens to be true.

A

Okay. So how would you take this? And now hook it up to an actual application right. This is just sort of hello world, but we won't actually show how you would integrate this into an actual. You know application all right. So I mentioned this already, but basically the results said if it's empty. In this case, you would deny if it was non-empty you would. You would allow the request- and so this is. This is an example of how you would integrate opah with the gorilla mocks package.

A

So I don't know if anybody here is familiar with gorilla mocks, it's a really simple HTTP router built on top of the standard library very few dependencies, and so here we've created a router we've registered the end point salary ID with it. We provided this salary, get implementation below, and then we've also registered this this piece of middleware that we called authorize here so that third line in the main function registers an authorizer on the router, and so what we're gonna do is implement that authorizer using OPA.

A

So this is what the authorizer has to do. It's basically gonna get called before the other handlers that have been registered by the application. So before the actual application code runs, this codes, gonna run, and so what it has to do is first authorize the request. It has to decide whether other question be. If there was an error during that process, you know you'd return, 500 or something. If there was a if it was supposed to be denied, you return 403. Otherwise, you just invoke the applications Handler and.

B

So this is what.

A

It looks like so again you go and construct your Rago object. You provide the policy that you want to have evaluated. You provide the handle to the storage that you want to use. You provide the input which you're going to construct from the HTTP request, that's being serviced right now and then the query to run, and then you just interpret that just like before. So if there was an error, you return 500 if the result set is empty, meaning there's no way that this could possibly be true. Then you deny the request.

A

Otherwise you like the application code, and so that's it. That's actually all you'd have to do to get a simple integration going with with an HTTP package like gorilla MUX. So if you'd like to look at this example in more detail, I've posted it on my github account torrent, piece and I'll, slash, koukin, Shanghai 2018. If you're interested in integrating or embedding open as a library go, look at the go doc examples for the project.

A

They go into fairly good detail with examples of how to do that and, if you're interested in seeing like a full-blown integration for an go for HTTP API authorization. Look at the example: API Ozzy go repo under the open policy agent organization. That has examples of what I showed you just now, as well as how you can configure open to pull down policies from a bundle, server report status for port decision logs and so on, and that's it. So. Thank you very much I'm happy to take questions or answer anything like that.

A

We do have this slack organization that I mentioned before. So, if you have questions after the conference, please join the slack org lots of friendly people on there. That's the github repo! You can check out the code, go star, the repo, if you, if you like it and if you're interested in contributing we have a bunch of issues that are tagged as low-hanging fruit, as well as Help Wanted, and so those are great places to get started with contribution. So thank you.

A

C

It might be like an existing CEO questions. First great work, I think there's a space for this. The question is: do you see this getting into the space of rules management because it feels a lot like rules management where you provide the facts and you provide the policy and you ask for evaluation of those facts against the policy.

A

What do you mean by rules management? Because.

C

The rules, management and rules measurements- it's it's. It's like it's kind of a so problem in so many ways. So, like you said like these are the rules these are. My facts could be like hundred megabytes of facts like match them against my rules, and then you get results could be like red scoring. So a credit score. It's a great example for rules manager. You know and just like, if thinking where you would like the project to go.

C

If you see you getting to more complex use case such as like time window base authorizations, because you need to start thinking about like a stream of data instead of just a plane like a set of facts,.

A

Yeah, so people have looked at OPA and compared it to like projects like drools and, for example, I think that OPA, it's a you, know a hole in the ecosystem today, I, don't think, there's a good alternative really in the open source ecosystem today, in terms of like drools, is a very heavyweight system, for example like definitely not embedding it as a library easily opens very easily embeddable we've seen a lot of traction with OPA around admission control and enforcing invariance over infrastructure. Part of that has to do with the way the language is designed.

A

It's very good at that certain rule systems aren't as aren't as good of a fit for that. They don't allow you to. You, know, take one policy and then use it for both enforcement online, as well as offline auditing, for example. So opens a great bit for that, and it's also quite performant, so you know like at Netflix. They have certain policies that have to you know that always have to execute an under.

A

You know certainly no more than a millisecond right, but under 100 microseconds in a lot of cases, and so we've put a lot of work into making sure that opens performing enough for those high frequency, low, latency use cases. So I definitely think that there's a there's a fit for it and the users seem to agree as well.

B

So if you have policies that you want to to enforce, like let's say throughout your your infrastructure or in in every service, so since OPA seems to be very service dependent, so the services themselves are supposed to. You know call upon OPA to see. If these you know, conditions pass, muster, etc.

B

Is there any way of enforcing those services to to properly use OPA I mean to make sure that, like you know some team that doesn't know what they're doing comes onboard and deploy services that aren't OPA compliant the way that you would want them to be yeah.

A

And so are you talking about like API authorization or more just more generally, like in the case of API authorization, yeah.

B

Just complete just completely broadly yeah.

A

So you know things like external admission, control and kubernetes right, like a developer, can't opt out of that right. Once the administrator deploys OPA and configures it with policies, then you know all the workloads that are being deployed or subject to those policies and there's no way to get out of that with API authorization. If you're using a service, you know service smash project like sto or using envoy, or something like that.

A

Then again, it's outside of the application developers control right, it's happening before their code even executes, and even if you've got a library integration like with spring or something like that or guerilla right, it's not really the application developer.

A

Writing that code necessarily to do the call out to oh, but it's you know, one team that manages the frameworks on the runtimes inside of the sign up the inside of the organization, so yeah so I think that, but at the end of the day you know if they don't do that integration correctly, then you know it's not gonna, get it properly right.

B

So, if, if you want to make sure that that, if your finance and you don't want anybody to make withdrawals over ten million dollars or something, somebody could still write a service, though that allows that you wouldn't be able to say, but you wouldn't be able to enforce that across all services. You.

A

Have to go into the service the deals with for drawls and then make sure that it's you know talking about.

B

Right right, exactly okay, I see what you mean: yeah I,.

C

Am service yeah? What policies do I have like so externalize policy configuration you.

A

You could do that. Usually we don't even recommend that you provide a name when you invoke oh, but you just provide a bunch of input, attributes and then over returns, a decision to you. That's been sort of the best practice that we've seen that way that you don't have to configure the services very much. It's just you know hostname and port, or something like that to call OPA and then provide JSON and get JSON out done. I think we're running on time, so I'm happy to do questions afterwards as well.

A