From d57c3a7672a56b12dae1e52dcf1b8c93bd5535bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=C3=B6tzinger?= Date: Thu, 27 May 2021 15:06:26 +0200 Subject: [PATCH] Update open-policy-agent.md --- radar/2021-01-01/open-policy-agent.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/radar/2021-01-01/open-policy-agent.md b/radar/2021-01-01/open-policy-agent.md index 0c9d197..c0f1904 100644 --- a/radar/2021-01-01/open-policy-agent.md +++ b/radar/2021-01-01/open-policy-agent.md @@ -7,6 +7,10 @@ quadrant: tools [Open Policy Agent](https://www.openpolicyagent.org/) (OPA) is a framework which allows to model and evaluate policies access services. The underlying expression language *rego* is purpose-built for the policy evaluations and implements the **Policy As Code** patterns. -The utility of OPA and Rego comes from the various integrations into other cloud-natives services and tools. It can be part of the Kubernetes Admission Control process, can be used for authorization decisions within a Service Mesh or could be part of infrastructure evaluation pipelines. +This allows to decouple policy from the service's code so you can release, and review policies seperatly for example. + +The benefits of using OPA and Rego comes from the various available integrations into other cloud-native services and tools. It can be used with the "Kubernetes Admission Controller", to authorize decisions within a Service Mesh or as part of infrastructure evaluation pipelines. We use OPA in some of our infrastructure pipelines to ensure that changes don't have undesired impact or within Kubernetes to evaluate the overall conformity of our deployments with the given policies. + +We have also evaluated OPA as part of a permission management concept in larger distributed architectures.