What is OPA and how does it work?
OPA is a lightweight authorization engine that fits well in Kubernetes. It didn’t get its start in Kubernetes, but it’s certainly found a home there. There’s no requirement to build dynamic admission controllers in OPA, but it’s very good at it and there are extensive resources and existing policies that can be used to start your policy library.
This section provides a high-level overview of OPA and its components with the rest of the chapter getting into the details of an OPA implementation in Kubernetes.
OPA architecture
OPA comprises three components – the HTTP listener, the policy engine, and the database:
Figure 11.1: OPA architecture
The database used by OPA is in memory and ephemeral. It doesn’t persist information used to make policy decisions. On the one hand, this makes OPA very scalable since it is essentially an authorization microservice. On the other hand, this means...
