►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Open Policy Agent - Torin Sandall & Tim Hinrichs, Styra
Come to this session to hear from Tim Hinrichs and Torin Sandall, the co-creators of the OPA project. This session will provide a quick overview of OPA and then dive into recent developments and plans for the future. If you want to learn more about OPA or get involved, this session is for you!
https://sched.co/MPk0
A
Hey
folks,
how
you
doing
we're
gonna
go
ahead
and
get
started
so
today
we're
gonna
be
talking
about
the
open
policy
agent.
We're
gonna
be
doing
a
deep
dive,
but
before
we
get
started
and
we'll
do
questions
at
the
end,
like
always
before
we
get
started,
let's
get
a
census
to
who
here
has
used
OPA
before
ok
and
then
so,
if
you
haven't
ever
used,
OPA
raise
your
hand
all
right,
very
good.
That's
helpful!
All
right,
all
those
that
used
it
who's
used
it
like
in
production,
you've
actually
rolled
it
out,
got
a
couple.
A
B
A
All
right.
So
the
way
we
thought
we'd
get
this
started
is
to
just
talk
about
a
simple
application
as
an
example
write
applications
we
build
them
all
the
time
or
at
least
some
of
the
folks
that
we
work
with
do
and
in
this
application
it's
sort
of
a
standard
end-user
application.
We've
got
Bob
our
end
user
logs
into
a
portal.
It's
maybe
some
sort
of
maybe
banking
app.
Here.
We've
got
payments
and
accounts
of
promotions.
Those
are
all
micro
services,
that's
great
they're,
all
backed
by
some
sort
of
storage,
right
s3.
A
Maybe
we're
running
on
Amazon
sequel
for
standard
relational
stuff.
Maybe
we're
using
some
partner
API.
Is
there
some
third
party
API
is
like
Twilio
or
than
stripe,
and
so
one
of
the
observations
that
we
make
is
that
in
this
kind
of
application,
there's
a
bunch
of
authorization,
there's
a
bunch
of
policy
that
needs
to
be
put
in
place
for
that
end,
user
right,
so
Bob,
our
end
user
is
authorized
to
read
balances
on
his
accounts,
but
obviously
not
everybody's
accounts.
A
We
also
know
that
there's
a
different
kind
of
authorization
sort
of
that,
the
next
layer
down
sort
of
the
micro-service
layer.
So
maybe
payments
here's
authorized
to
talk
to
accounts,
but
account
is
not
authorized
to
talk
to
notifications
right.
That's
another
kind
of
authorization,
that's
another
kind
of
policy
that
we
end
up
having
to
put
into
our
applications.
We
also
have
Alice
who's,
one
of
our
developers.
She
also
has
access
to
all
of
the
different
kinds
of
components
of
this
application.
She
has
access
to
the
database.
Why?
A
Because
maybe
sometimes,
when
she's
on
call
she
has
to
debug
what's
going
on
in
production,
she
needs
to
look
at
some
of
those
records.
She
also
has
access
to
the
micro
services
and
to
s3
write
again.
Alice
is
another
stakeholder
in
this
game
where
authorization
and
policy
is
important.
Who
can
do
what
is
important
for
for
both
of
these
end
users,
as
well
as
the
micro
services
II
that
you
see
on
the
screen
and
for
other
kinds
of
stakeholders
as
well?
A
Maybe
you're
talking
about
the
security
team
has
certain
rights,
maybe
you're
talking
about
the
customer
support
team,
which
sometimes
gets
to
look
at
database
entries
that
correspond
to
customers.
Who've
opened
tickets
against
the
application,
the
end
of
the
day,
there's
authorization
and
policy
spread
throughout
this
application.
A
The
challenge
here
released.
One
of
the
challenges
is,
though,
that
before
OPA
often
it
was
a
case
that
every
one
of
those
micro
services
was
built
by
a
different
team
and
therefore
each
one
had
its
own
way
of
solving
the
authorization
problem.
Each
of
the
database
is
certainly
sequel.
We've
all
used
grant
and
the
end
and
grant
statements
and
sequel.
That
is
a
different
authorization
system
s3.
A
So
they're
a
bunch
of
obvious
questions
here
right
so
once
you've
got
all
of
these
different
kinds
of
authorization
systems.
How
do
you
use
them?
This
somebody
comes
down
and
says:
here's
a
new
rule.
Alice
can
only
SS
production
databases
when
she's
on
call
she
can
only
ssh
into
production
servers
when
she's
on
call.
How
do
you?
How
do
you
implement
that?
How
do
you
enforce
it
right?
You
have
to
know
and
understand
several
different
API,
several
different
authorization
models
for
each
of
the
different
components
of
that
system
in
order
to
implement
those
those
policies.
A
Likewise,
if
you
think
about
a
question
of
compliance
comes
along
and
says,
prove
to
me
who
can
access
what
again
you've
got
to
go
into
each
of
those
different
systems,
you've
got
to
understand
how
they
work.
You've
got
to
pull
out.
Who
can
access,
what
from
each
of
those
different
systems,
aggregate
them
together
and
return
a
result
to
your
to
your
compliance
officer.
Another
good
question
that
comes
up
is
data,
like
authorization
is
not
something
that
is
typically
done
in
a
vacuum.
A
Often,
there's
a
bunch
of
external
data
about
what's
going
on
in
the
world,
that's
important
and
to
make
those
correct
authorization
decisions.
For
example,
in
an
org
chart,
maybe
managers
have
different
rights
than
than
individual
contributors,
and
so
that
kind
of
data
or
for
the
end
user
is
another
good
example.
Here
is:
maybe
I've
got
a
hundred
million
users,
obviously,
who
owns
which
object
is
an
important
piece
of
data
that
I
need
in
order
to
make
authorization
decisions.
A
So
how
do
you
fold
that
in
to
the
authorization
landscape
all
right,
but
the
problem
doesn't
in
there
it's
not
just
an
application
problem.
Many
of
us
here
today
are
probably
working
on
kubernetes
and
in
some
way
shape
or
form
or
some
other
platform.
Maybe
we're
running
that
application
on
VMs.
Maybe
you
were
running
it
on
bare
metal
here.
We've
got
an
example
of
running
that
application
on
kubernetes
and
we
have
the
same
kind
of
kind
of
picture
in
the
sense
that
there
are
all
these
different
components.
A
We've
got
ingress
is
set
up
to
serve
the
payments.
Urls
we've
got
the
payments
pods
running
on
node
we've
got
persistent
volumes
that
are
connected
to
those
pods
again.
All
of
those
different
components
are
something
that,
especially
if
we're
embracing
DevOps
Alice
are
developing.
Her
has
access
to
she's,
going
to
be
able
to
put
those
persistent
volumes
in
place.
A
She's
gonna
be
able
to
launch
deployments
and
ingress
is,
and
so
on
and
so
forth,
and
our
administrator
Amanda
is
going
to
want
to
put
a
bunch
of
guardrails
a
bunch
of
safeguards
around
those
different
components
of
the
platform.
Those
safeguards
are
just
another
kind
of
authorization.
That
administrator
is
just
authorizing
the
developers
and
the
operators
and
the
platform
engineers
to
but
certain
resources
in
place
with
certain
configurations.
You
know,
we've
got
good
examples
around.
A
You
know
ensuring
that
all
the
images
that
get
deployed
onto
my
cluster
come
from
a
trusted
repository.
The
administrator
is
going
to
want
to
make
sure
that
all
ingress
is
that
get
deployed,
never
conflict
with
another
ingress.
Again,
that's
just
another
form
of
authorization.
The
admin
is
going
to
want
to
make
sure
that
every
pot,
every
deployment
is
affixed
with
CPU
and
memory
limitations
to
make
sure
that
they
don't
eat
up
a
bunch
of
resources.
A
All
of
these
are
different
forms
of
authorization,
and
so
this
is
the
problem
that
we
set
out
to
solve
and
we
started
OPA.
There
are
all
kinds
of
different
authorization
throughout
your
stack,
and
that
makes
it
hard
to
deal
with
the
actual
authorization
problem
in
the
real
world.
You've
got
to
take
that
those
authorization
policies
from
the
real
world
and
implement
them
across
many
different
layers
of
the
stack
using
many
different
api's
authorization
models
and
authorization
systems.
Ople
is
designed
to
unify
policy
enforcement
across
the
stack.
A
So
here's
a
the
picture
that
we
usually
like
to
show
it
at
the
booth
come
by.
If
you
haven't
already
to
show
all
the
different
components,
all
the
different
integrations
that
that
exists
for
OPA
right.
So
we've
talked
about
microservices
down.
On
the
left
hand,
side,
people
often
ask
what
about?
How
does
it
open
correspond
to
sto
and
envoy
and
linker
D
and
so
forth?
We've
got
integrations
with
all
of
those.
A
If
you
think
about
risk
management
on
the
public
cloud
again,
they're
they're
they're
people
using
OPA
to
do
that
kind
of
public
cloud
authorization,
data
protection,
container,
execution,
SSH
and
sudo.
These
are
all
integrations
that
oppa
has
out
of
the
box.
One
of
the
most
popular
is
kubernetes
kubernetes
and
Mission
Control.
This
is
something
that
we
highlighted
on
that
last
slide,
because
so
many
people
are
using
OPA
are
starting
to
use
it
for
admission
control.
How
do
I
put?
A
A
That
is
that
service
at
some
point
in
time
needs
an
authorization
decision
or
it
needs
a
policy
decision,
and
so
that
service
will
ask
open
I'll,
say:
here's
some
information,
here's
a
JSON
object,
it
represents
an
HTTP
API
or
a
kubernetes
admission
review
request
it
hands
that
chunk
of
JSON
to
Opa
Opa
makes
its
decision
using
Rago,
which
is
a
policy
language
and
any
external
data
that
you
that
you
happen
to
inject
into
Opa
Opa
makes
a
decision.
It
returns
it
to
that
service.
A
The
service
in
turn
takes
a
decision
and
does
the
enforcement
right,
so
one
key
idea
behind
opens
that
we're
trying
to
decouple
policy
decision-making
from
policy
enforcement.
It's
a
services
job
to
do
the
actual
enforcement.
It
is
oppa's
job
to
make
the
decision.
So
that's
one
sort
of
dimension
that
we've
articulated
OPA
can
be
integrated
with
many
different
systems
across
many
different
layers
of
the
stack
that
isn't
in
one
sense.
A
Why
does
general
purpose
the
other
dimension
and
would
it
in
which
its
general
purpose
is
that
the
policy
decisions
at
OPA
makes
can
be
allowed
an
AI?
They
can
be
true/false
standard,
classical
authorization,
but
the
decisions
that
open
makes
can
also
be
arbitrary,
JSON
objects.
So
let
me
give
you
a
few
examples.
If
you
want
to
think
about
policy
decisions
that
end
up
as
a
rate
limit
rate
limits,
open
would
return
a
number
if
you
want
to
return.
A
Let's
say
a
hostname
that
describes,
which
host
you're
supposed
to
connect
to
OPA
would
return
a
string
if
you're
returning
and
allow
deny
decision.
Opa
returns
a
true
false
if
you're
returning
the
list
of
clusters
to
which
you
should
deploy
this
application,
you
would
have
OPA
return
and
array
of
those
cluster
names
and
in
kubernetes
case
we
use
this
all
the
time
if
you
want
it,
for
example,
return
a
kubernetes
object
and
api.
Sorry
an
admission
review
response
that
would
be
a
full
JSON
object.
So,
regardless
what
kind
of
information
you
want
to
return?
B
B
We've
got
over
800
people
on
slack
now,
we've
got
over
2,000
stars
and
recently
we
started
tracking
the
number
of
public
repos
on
github
that
contain
Rago
files
and
that's
a
super
interesting
metric
because
it
tells
us
you
know
how
much
people
are
actually
really
working
with
it
for
real,
and
so
one
of
the
things
that's
been
driving.
A
lot
of
this
adoption
has
been
a
bunch,
a
bunch
of
related
use
cases
around
putting
guardrails
over
or
over
configuration
right.
So
primary.
B
This
is
around
kubernetes
admission
control,
but
it
applies
equally
across
a
bunch
of
different
platforms
like
you
know,
GCP
or
AWS,
or
if
you're,
using
terraform
or
really
any
kind
of
structured
data
right.
So
all
of
these
these
platforms,
all
of
these
infrastructure
services,
basically
expose
their
configuration,
their
desired
state
as
structured
data,
and
let
you
control
it
right
so
that
you
basically
end
up
handing
over
control
of
compute
network
and
storage
resources
to
developers
within
your
organization,
and
they
have
the
ability
to
do
things
like
the
set
up
network
policy
or
control.
B
You
know
resource
allocation,
or
you
know,
control
application,
ingresses
and
so
on.
Right
and
so,
if
you're,
not
careful
with
those,
what
many
organizations
find
is
that
it's
very
easy
to
shoot
themselves
in
the
foot
and
so
OPA.
You
know
a
lot
of
companies
are
using
open
today
to
solve
policy
related.
You
know
problems
around
these.
These
platforms
and
I
think
one
of
the
reasons.
One
of
the
main
reasons
for
that.
B
How
often
is
it
just
like
a
flat
yamo
file,
where
it's
just
like
a
map
of
the
string
to
another
string
right
like
one
hand,
okay
to
ants?
Never
right,
you
basically
always
have
these
super
deep
complex.
You
know,
gamal
objects
that
you're
interacting
with
right
and
what
opus
language
is
really
good
at
doing.
Is
is
basically
helping
you
codify
policies
and
constraints
and
rules,
and
so
on
over
that
deeply
nested
structured
data.
B
The
other
thing
that
people
have
started
to
pick
up
on
lately
is
the
the
importance
in
the
duality
between
enforcement
and
auditing
right.
So
a
lot
of
people
are
using
open
just
for
admission
control
today
to
enforce
you
know,
admission
policies
in
their
clusters,
but
one
of
the
nice
attributes
of
open
and
it's
policy
language
is
that
it
lets.
You
write
one
policy
and
then
ask
different
questions
of
that
policy.
B
So
obviously
you
can
deploy
that
policy
and
have
it
ask
the
question
you
know:
should
this
pod
be
created
in
this
namespace,
but
you
can
also
use
it
to
ask
the
question.
You
know
what
resources
in
my
cluster
would
violate
this
Paul.
If
the
policy
were
to
be
deployed-
and
that's
super
helpful,
for
you
know
compliance
purposes,
it's
super
helpful,
for
you
know
gaining
confidence
in
your
policies
before
you
deploy
them
and
so
on.
B
But
there
are
a
number
of
other
interesting
use
cases
that
I
just
want
to
highlight
today.
One
of
those
is
just
around
application
authorization
which
we
talked
about
a
minute
ago,
so
chef
recently
open
sourced
all
of
their
proprietary
code
and
one
of
the
one
of
the
products
that
they
have
is
chef,
automate
and
chef.
Automate
has
an
iam
capability
right.
Every
time
you
ship
an
application
to
enterprises,
it
needs
to
have
some
sort
of
authorization
ID
any
access
control.
B
B
How
should
I
define
my
permission
model
my
access
control
model
and
so
chef
has
done
a
lot
of
work
to
define
a
role
based
access
control
model
and
a
project
scoped
access
control
model
which
they've
gone
and
documented
and
described
really
well,
they've,
also
sort
of
documented
their
architecture.
They've
they've
described
how
they
integrate
OPA
as
a
library
how
they
deal
with
policy,
storage
and
so
on.
B
B
Well,
the
first
thing
that
we
that
I
want
to
talk
about
is
this
new
thing
called
the
playground,
the
opah
playground.
So
if
you
go
to
played
open
policy
agent
org
today,
you
can
just
try
this
out.
We
released
this
earlier
this
year
and
we've
seen
a
lot
of
people
really
enjoy
using
this
to
try
out
open
with.
B
So
what
I
thought
I'd
do
is
just
kind
of
give
a
little
bit
of
an
example
of
how
this
works,
and
so
this
is
gonna
load,
something
we
have
internet
which
we
do
is
I'm
gonna
make
that
a
bit
bigger.
So
this
is
just
a
simple
admission.
Control
example
right:
this
is
actually
just
pulled
out
of
the
open
documentation.
B
This
is
just
a
deny
rule,
it's
just
a
rule
called
deny,
and
it
basically
says
that
deny
will
contain
a
message
if
the
input
is
an
ingress
object
and
that
ingress
object
has
a
host
and
the
there's
another
ingress
object
that
exists
inside
of
OPA.
That's
been
loaded
in
that
has
the
same
host
name
as
this
one,
either
under
under
in
the
input,
and
if
that's
the
case,
then
we
generate
an
error
message.
So
this
is
basically
checking
for
hostname
conflicts
in
ingress
objects
in
an
inner
kubernetes
cluster
and
I've.
B
Just
I've
just
got
it
hard-coded
the
the
external
ingress
below
here
for
demo
purposes.
So
one
of
the
nice
things
about
this
is
that
I
can
just
hit
output
here
and
the
policy
gets
evaluated
and
the
result
gets
printed
here,
and
so
you
can
see
that
right
now,
there's
a
there's,
a
there's,
a
single
element
in
the
deny
array,
and
the
reason
for
that
is
because
I've
got
input
as
well
and
I've
defined
the
input
document
in
the
browser
here
and
I've
specified.
Basically,
the
admission
review,
webhook
object,
and
so
that's
basically
the
full.
B
You
know
kubernetes
ya,
know
file
effectively
just
represented
as
json
and,
and
so
I
can.
I
can
basically
put
this
this
json
data
into
the
browser
and
evaluate
the
policy
and
see
the
output,
but
it's
a
little
bit
more
powerful
than
that,
because
what
I
can
actually
do
is
I
can
select
arbitrary
parts
of
the
policy
and
evaluate
those
as
well.
B
You
can
actually
select
like
arbitrary
parts
of
the
the
rule,
and
so,
if
I
just
go
down
here
and
I
select
this
part
of
the
rule
body
and
I
hit
evaluate,
then
it
basically
prints
out
the
values
for
the
variables
that
oppa
found
that
satisfy
the
rule
right
and
so
just
the
fact
that
I
can
go
in
here
and
I
can
edit
these
rules
and
I
can
edit.
The
the
input
and
I
can
try
it
out
is
super
super
valuable
from
comment
from
sort
of
like
a
learn,
an
education
perspective.
B
So
if
I
it's
a
little
bit
hard
to
type
and
select
at
the
same
time
but
I'm
okay,
there
we
go
so
there
I
changed
the
input,
and
now
it's
it's
no
longer
conflicting
it
so
I
get
an
undefined
back
so
anyway.
So
this
is
the
playground.
I
recommend
that
if
you're
trying
to
you
know
if
you're
playing
with
the
language
you're
trying
to
learn
how
to
write
policy,
try
out
the
playground,
it's
super
useful
I
think
it's
a
powerful
tool
to
get
started
with.
B
So,
along
the
lines
of
helping
you
kind
of
like
work
with
policies
and
debug
them,
one
of
the
things
that
we
found
is
that
oppa
has
this.
This
feature
called
tracing,
which
you
can
enable
when
you
do
a
query
and
by
default
the
tracing
feature
returns
a
lot
of
information,
and
sometimes
that's
that's,
that's
useful,
but
sometimes
it's
also
a
little
bit
confusing
oppan
also
has
this
thing
called
the
trace
built-in
function
which
lets
you
emit
a
message
to
the
trace.
B
B
Another
thing
that
we've
been
sort
of
looking
at
lately
are
improvements
to
the
language,
and
one
thing
that
we
saw
become
a
little
bit
of
an
issue
in
in
much
large
policies.
Very
large
policies
was
the
fact
that
by
default,
variables
will
basically
capture
global
values.
So
what
that
means
is
that,
like
in
this
example,
in
the
before
case
user
in
the
body
of
the
rule,
actually
refers
to
the
global
user,
that's
defined
outside
of
the
rule,
and
this
is
often
really
nice.
B
It
allows
you
to
write
very
kind
of
readable
policies,
but
at
the
same
time
it's
it
can
be
frustrating
because
if
you
introduce
a
global,
it
might
change
the
behavior
of
some
of
your
rules,
and
so
it
can
be
kind
of
confusing
in
certain
cases
and
so
we've
earlier
early
last
year
we
introduced
an
assignment
operator
and
that
resolves
a
lot
of
these
these
cases.
But
there
were
some
other
cases
around
pattern
matching
and
reference
operands
that
didn't
get
handled
by
the
the
dart
not
handled
by
the
assignment
operator
and
so
to
address
those
cases.
B
B
B
Webassembly
is
basically
a
binary
instruction
format
for
representing
virtual
machines,
and
it's
it's
being
used
for
a
bunch
of
different
use
cases.
A
lot
of
people
are
excited
about
it.
You
know
allowing
you
to
run
native
code
in
the
browser,
but
there
are
a
bunch
of
non
browser
non
web
and
betting's
that
are
also
very
interesting
and
because
it's
designed
for
the
internet,
because
it's
designed
for
the
web,
it
has
really
nice
properties
around
safety
and
efficiency
and
portability
that
make
it
an
ideal
runtime
for
policy
evaluation.
B
So
the
goal
of
this
this
webassembly
integrations
web
assembly
compiler,
is
to
basically
allow
you
to
embed
OPA
policies
and
have
them
evaluated
in
any
language
or
any
runtime
right
without
requiring
a
standalone
daemon
to
run
alongside
your
application.
And
so
the
way
this
basically
works
is
that
we've
just
extended
the
OPA
compiler
to
basically,
instead
of
you
know,
just
emitting
an
ast
that
gets
interpreted
and
go.
A
Yeah
so
looking
forward,
what
are
we
gonna
be
looking
at
over
the
next
few
months?
There
were
really
a
three
three
things
that
I
wanted
to
cover,
one
of
which
is
that
this
summer,
the
google
Summer
of
Code
we're
gonna
have
a
project
around
building
an
IP
tables
integration,
so
irvil
patel
is
an
undergraduate
and
the
crushinator
is
one
of
the
community
members,
who's,
mentoring,
Ervil,
and
so
the
idea
for
this,
this
particular
project
is
pretty
simple.
A
It
is
the
same
diagram
that
you
saw
at
the
near
the
beginning
of
the
talk
here,
though,
the
decisions
that
opens
gonna
be
making
is
sort
of
the
desired
state
for
the
IP
tables
on
running
on
Linux,
and
then
the
controller
that
Ervil
is
implementing
will
go
ahead
and
periodically
pull
open
and
say,
hey,
give
me
the
desired
state,
then
it'll
go
ahead
and
render
that
desired.
State
down
into
unex
iptables,
alright,
so
very
a
classic
sort
of
implementation
of
of
open
some
sense.
A
But,
but
is
this,
this
does
have
the
the
hallmark
of
like
a
kubernetes
controller
too
feels
very
similar
right.
Give
me
the
desired
state
and
I'll
make
sure
that
that
is
rendered
down
on
the
the
actual
software.
All
right,
so
that's
happening,
thank
you
to
CN,
CF
and
Google
for
sponsoring
this
year.
A
Second
thing
that
I
wanted
to
cover
was
that
you
know
when
we
started
out.
The
very
first
example
we
gave
of
of
authorization
is
really
around
this
end:
user
app
and
application
authorization
right
where
you've
got
an
application.
You've
got
a
bunch
of
different
authorization
issues
that
you
need
to
solve,
and
so
we
had
also
on
the
slide
a
bunch
of
different
questions
there.
A
So
that's
one
thing
that
we'll
be
looking
at
another
is
that
you
know
we
talked
a
bit
earlier
about
data
and
so
a
lot
of
authorization
decisions
need
a
bunch
of
data
in
order
to
make
those
decisions.
You've
got
a
hundred
million
users.
Typically,
what
we'll
do
in
oppa's
will
say
you
should
load
your
data
into
OPA
before
asking
it
to
make
a
decision.
A
So
we
basically
add
where
clauses
to
sequel
before
they
get
executed.
So
that's
something
that
we'll
continue
working
on
and
similarly
one
one
interesting
case
that
we've
run
into
is,
is
when
there's
just
too
much
data
to
eat
to
load
into
OPA
and,
moreover,
during
policy
evaluation.
People
have
asked
hey,
I'd,
like
open
to
reach
out
into
the
world,
grab
some
additional
data
and
make
decisions,
and
so
here
we're
calling
that
data
fetching.
A
So
that's
something
that
we
have
some
very
early,
very
experimental
support
for,
but
it's
something
that
again
we'll
be
investing
in
the
other
couple
of
items
on
this
list
are
a
really
amount
to
wasum
compilation.
So
you
know
one
of
the
questions
here
is
well
it's
great,
but
to
have
OPA
running
as
a
sidecar
next
to
each
of
my
micro
services
as
part
of
my
application,
that's
something
that
we
see
people
do
quite
often,
but
that
doesn't
work
for
my
front-end.
A
A
A
Here,
I
mean
you
know
what
I,
whenever
I
pick
up
a
new
language,
or
even
if
I'm,
just
rusty
on
a
language,
I'll
go
to
stack,
overflow
and-
and
you
know,
search
for
how
do
I
it
over
dictionaries
and
then
Stack
Overflow
just
give
me
that
exact
answer
today.
A
lot
of
that
same
Q&A
is
done
on
slack,
which
means
it's
much
harder
to
discover
it's
much
harder
to
search
for.
So
one
of
the
things
we'd
like
to
do
and
we'd
like
to
ask
you
all
to
help
us
with
moving
forward.
A
Is
that
when
you
pick
up
OPA
when
you
come
on
and
are
asking
questions
on
slack,
please
go
ahead
and
we'll
probably
ask
you
this
to
go
ahead
and
also
post
those
questions
on
Stack
Overflow
and
tag
them
with
open
policy
agent.
So
we
can
go
ahead
and
answer
them
there
and
make
them
searchable
for
everybody
else.
C
Hey
this
question
is
regarding
unwind
aggression
of
OPA.
Basically,
so
it
looks
like
it
is
integrated
with
national
cloth
filter
right
today.
So
suppose,
I
want
to
do
a
subject,
alternate
name
validation
and
bypass
the
certificate,
details
OPA
and
create
a
no
policy
in
the
Opera
gent
can
I
do
reg,
X
validation
on
this
hand
today,
or
is
it
in
your
roadmap
to
support
reg,
X
validation
of
sense.
A
Yeah
so
right,
so
the
question
was
I'll
boil
it
down
to
do
you
support
reg
X's
today,
I
think
is
the
short
version,
and
so
yes,
there
are
oppa,
has
over
50
built-ins,
including
red
x's
and
globs,
and
an
basic
string
manipulation.
So
there
is
a
go
to
the
website.
Look
for
language
reference,
that's
usually
the
one
I
refer
to
every
now
and
again,
but
yeah
50-plus,
built-ins,
yeah
and
they're
easy
to
add.
So
if
there's
some
that
are
missing,
it's
very
easy
to
open,
PR,
yeah.
B
So
yeah,
the
question
is
around
like:
how
do
you
actually
read
feedback?
How
do
you?
How
do
you
get
the
data
that
you're
going
to
use
in
your
unit
tests
like
when
you're
writing
Rago,
and
this
is
something
that
I
think
we've
all
probably
experienced
the
first
time
we
do
it.
We
don't
have
great
tooling
right
now.
I
think
that,
so
what
one
feature
we
recently
released
is
just
a
standard
out
decision,
logger
OPA.
B
B
A
I
got
both
so
yeah
data
fetching
is
its
new.
It's
something
that
we're
gonna
be
putting
more
time
into
right.
Now
we
have
an
HTTP
send
built-in,
which
basically,
just
you
know
during
policy
evaluation.
You
can
send
an
HTTP
request
to
a
server
and
get
a
response,
and
then
obviously
that's
JSON
that
comes
back
in
and
then
you
do
the
the
usual
kind
of
regular
thing
to
process
the
result.
A
B
A
A
Yeah
yeah,
so
the
question
was
yeah,
so
the
question
was
she's
not
using
oppa
yet
but
she's
thinking
about
it
wants
to
know
how
flexible
the
language
and
schema
are.
My
my
rule
of
thumb
is
that
you
are
typically
more
limited
by
your
imagination
than
you
are
the
language.
That's
honestly,
what
we
find
is
like
people
think,
oh,
it's
like
you
know
in
the
old.
Typically
people
think
well,
here's
networking
policy,
so
you've
got
five
tuples
or
seven
tuples
or
it's
like
storage
policy,
so
you've
got
some
pre-built
stuff
in
there.