11–20 of 46 posts
Curious what folks think about this versus cedar ( https://www.cedarpolicy.com/ ), the open source policy engine behind aws verified permissions.
Check out Topaz [0], which uses OPA as its decision engine, but adds a data plane that is based on the ReBAC ideas explored in the Google Zanzibar [1] paper.
Disclaimer: I work on the team [2] that builds and maintains the Topaz project.
[1] https://research.google/pubs/zanzibar-googles-consistent-glo...
OPA was one of the most cursed things I have ever worked with.
OPA, or rego? My experience working for Styra was that most people seemed to grok where OPA fit in fairly quickly, but struggled with rego. It's a very powerful language and well worth learning I think, but it's an investment for sure.
OPA is a great tool for implementing a policy-as-code system. But if you're trying to use it for application authorization (e.g. fine-grained authz for B2B SaaS or a set of internal applications), you may find that its policy story is strong, but it doesn't really have a "data plane": you either store data in a data.json file and rebuild the policy any time that data changes, or make an http.send call out of the poli…
https://www.openpolicyagent.org/docs/latest/management-bundl...
Curious what folks think about this versus cedar ( https://www.cedarpolicy.com/ ), the open source policy engine behind aws verified permissions.
I detailed a comparison of OPA and Cedar with verified permissions here: https://www.styra.com/knowledge-center/opa-vs-cedar-aws-veri...
There's some other interesting work with spiffe/spire that I've been investingating for $WORK, could be useful to some on this path https://spiffe.io/docs/latest/microservices/envoy-opa/readme...
You can find our talk here https://www.styra.com/resources/videos/snap-inc--snaps-journ...
I have found OPA to be a fairly reliable and performant system in production. We were able to build a scalable RBAC solution that used OPA as evaluators. We had around 40k OPA instances serving around 350K qps with p99.9 hovering around 6ms. You can find our talk here https://www.styra.com/resources/videos/snap-inc--snaps-journ...
I have found OPA to be a fairly reliable and performant system in production. We were able to build a scalable RBAC solution that used OPA as evaluators. We had around 40k OPA instances serving around 350K qps with p99.9 hovering around 6ms. You can find our talk here https://www.styra.com/resources/videos/snap-inc--snaps-journ...
~9qps per instance doesn't sound all that impressive unless there's more context to it?
I have found OPA to be a fairly reliable and performant system in production. We were able to build a scalable RBAC solution that used OPA as evaluators. We had around 40k OPA instances serving around 350K qps with p99.9 hovering around 6ms. You can find our talk here https://www.styra.com/resources/videos/snap-inc--snaps-journ...