{"id":16880041,"url":"https://github.com/anderseknert/opa-demo","last_synced_at":"2025-03-20T02:32:25.533Z","repository":{"id":109367140,"uuid":"288300006","full_name":"anderseknert/opa-demo","owner":"anderseknert","description":"Demo material for Open Policy Agent","archived":false,"fork":false,"pushed_at":"2021-09-14T15:11:59.000Z","size":81,"stargazers_count":5,"open_issues_count":1,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-14T20:50:41.848Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anderseknert.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-17T22:32:39.000Z","updated_at":"2024-01-19T15:44:31.000Z","dependencies_parsed_at":"2023-03-13T14:14:17.088Z","dependency_job_id":null,"html_url":"https://github.com/anderseknert/opa-demo","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fopa-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fopa-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fopa-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anderseknert%2Fopa-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anderseknert","download_url":"https://codeload.github.com/anderseknert/opa-demo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244538589,"owners_count":20468745,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T15:57:03.531Z","updated_at":"2025-03-20T02:32:25.512Z","avatar_url":"https://github.com/anderseknert.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OPA Demo\n\n## Microservice authorization\n\nExample using OPA for authorization in an n-tiered microservice architecture, where the API tier on top forwards requests down to the orchestration tier below, who in turn forwards requests to the service(s) running in the service tier. Where does the authorization happen? Everywhere! Each service is responsible for enforcing it's own authorization decision, as provided by it's OPA sidecar.\n\n### Setup\n\nRun the `setup.sh` script in the project root directory. This will create a new kind cluster and deploy the demo resources to that.\n\n### Running\n\nFirst, issue a token to use for API authentication. The roles contained in the claims will be used for authorization decisions.\n\n```shell\ntoken=$(jwt encode --secret supersecret --sub anders '{\"roles\": [\"api-reader\"], \"aud\": \"opa-demo\"}')\n```\n\nNext, send a request to the externally exposed service running in the API tier:\n\n```shell\ncurl -H \"Authorization: Bearer ${token}\" http://localhost/opa-demo-api\n```\n\nThe response returned should report authorization status for each tier reached.\n\n### Demo\n\n1. Review setup.sh\n2. Review the kubernetes resource definitions and sidecar patch\n3. Review the policy\n4. Review the python app code\n5. If time allows - policy change\n\n## Identity\n\nOAuth and OpenID Connect policies and helpers.\n\n## Kubernetes\n\nVarious policies and functions to help work with kubernetes.\n\n## RBAC\n\nRBAC implementation in Rego.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanderseknert%2Fopa-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanderseknert%2Fopa-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanderseknert%2Fopa-demo/lists"}