Opa: Integration with Hashicorp tools

[hauleth]

It would be nice if there would be some kind of integration with

• []
• []

Like:

• Fetching registered services directly from Consul
• Checking JWT token signature against stored secret
• Fetching secrets from Vault
• Fetching data from Consul KV

[arcurtis]

Hi @hauleth. I agree that integrations with Consul and Vault would be great, and the specific examples you mention would be very useful. We do plan to implement integrations for both Consul and Vault, though I can't promise a timeline for when that will happen.

Most likely implementation of these integrations would not be directly in OPA. Instead it would be a sidecar process similar to the Kubernetes integration (https://github.com/open-policy-agent/kube-mgmt). That is, the sidecar process fetches the data from Consul or Vault, transforms it as necessary, and then pushes it to the OPA server.

Do you have any more details you could share with us? Knowing your use cases would be especially useful.

[tanner-bruce]

A use cause I can see for Consul would be to allow people to specify access to certain services based on tags on those services.

The somewhat newly released Kubernetes pod auth backend for vault would help out with this

[hauleth]

The point is to have open source alternative to Hashicorp's Sentinel. This would allow me to programatically define complex permission system for use in my own cloud.

[leecalcote]

@hauleth are you aware of a comparison of the two (sentinel v opa)?

[tsandall]

Sentinel has some similarities to OPA:

• Based around the idea of "policy as code": codify policy decisions in software, apply s/w engineering best-practices, but importantly, keep decisions decoupled from service business logic.
• Make policy decisions based on context.
• Provides simulator tooling for development, e.g., test, format, etc.

There are a few important differences between Sentinel and OPA:

• Sentinel implementation is proprietary and closed source
• Sentinel is only applicable to Hashicorp products
• Sentinel is an imperative programming language (OPA is based on query language semantics)
• Sentinel is Turing complete (OPA puts restrictions on rules to prevent this, e.g., no recursion.)
• Sentinel supports mutation; function call args are passed by value, but not deep copied (OPA values are immutable)

[jrnt30]

Was this closed for a specific reason? As a very new entrant to the OPA ecosystem this was my first "this would be handy" thought too.

I think the OP is not asking for "Sentinel Compliance" but rather an easy way of augmenting a deployment to include support (probably very similar to the docker and istio plugins) to front/interact with the other Hashicorp products.

I may be wrong there and I also think using those as sources of "data" for OPA would also be very valuable.

[tsandall]

@jrnt30, I agree that more integration with HashiCorp projects would be nice. We currently have a tutorial that shows how you can use OPA to enforce policies over Terraform updates. If you're using Terraform, check that out.

I closed this issue because it wasn't clear what features were required in OPA. If there are specific features you think would be useful, feel free to file separate issues.

One thing we're trying to avoid is direct coupling between OPA and specific downstream projects. For example, we don't have any direct dependencies on Kubernetes in OPA. Instead, we have a separate project that integrates with Kubernetes (open-policy-agent/kube-mgmt). There are also other projects embedding OPA to integrate with Kubernetes [1][2]. I think we could follow a similar pattern with HashiCorp projects.

That being said, if there was some generic primitive we could add to OPA that would make it easier to integrate with HashiCorp projects, we're happy to include that.

Hope this helps.

[1] [Azure/kubernetes-policy-controller](https://github.com/azure/kubernetes-policy-controller)
[2] [replicatedhq/gatekeeper](https://github.com/replicatedhq/gatekeeper)

[jrnt30]

That is extremely clear, understandable and helpful, thank you. As I play with this a bit more I will create issues around explicit feature request if they seem fit.

As an aside, really enjoyed listening to the Software Engineering Daily episode where you explained the intent of the project so well. Thanks!

[hixichen]

this is 2020, I still think this could be an option to integrate with Vault (vault supports integrated storage, which not requires consul to be the data store.)

I guess the idea would be using OPA as the policy enforcement instead of Vault's policy.