Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

https://github.com/permitio/opal

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)
https://github.com/permitio/opal

authorization cedar microservices opa opal open-policy-agent oso policy policy-as-code pubsub realtime websocket

Last synced: 3 months ago
JSON representation

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)

Lists

README 

        


 opal





⚡OPAL⚡






Open Policy Administration Layer






    Tests





    Package





    Package





    Downloads






    Docker pulls






    Join our Slack!








## What is OPAL?



OPAL is an administration layer for Policy Engines such as Open Policy Agent (OPA), and AWS' Cedar Agent detecting changes to both policy and policy data in realtime and pushing live updates to your agents. OPAL brings open-policy up to the speed needed by live applications.



As your application state changes (whether it's via your APIs, DBs, git, S3 or 3rd-party SaaS services), OPAL will make sure your services are always in sync with the authorization data and policy they need (and only those they need).



Check out our main site at OPAL.ac, this video briefly explaining OPAL and how it works with OPA, and a deeper dive into it at [this OWASP DevSlop talk](https://www.youtube.com/watch?v=1_Iz0tRQCH4).



## Why use OPAL?



OPAL is the easiest way to keep your solution's authorization layer up-to-date in realtime. It aggregates policy and data from across the field and integrates them seamlessly into the authorization layer, and is microservices and cloud-native.



## OPA + OPAL == 💜



While OPA (Open Policy Agent) decouples policy from code in a highly-performant and elegant way, the challenge of keeping policy agents up-to-date remains.

This is especially true in applications, where each user interaction or API call may affect access-control decisions.

OPAL runs in the background, supercharging policy-agents, keeping them in sync with events in realtime.



## AWS Cedar + OPAL == 💪



Cedar is a very powerful policy language, which powers AWS' AVP (Amazon Verified Permissions) - but what if you want to enjoy the power of Cedar on another cloud, locally, or on premise?

This is where [Cedar-Agent](https://github.com/permitio/cedar-agent) and OPAL come in.



## Documentation



- 📃   [Full documentation is available here](https://docs.opal.ac)

- 💡   [Intro to OPAL](https://docs.opal.ac/getting-started/intro)

- 🚀   Getting Started:



  OPAL is available both as **python packages** with a built-in CLI as well as pre-built **docker images** ready-to-go.



  - [Play with a live playground environment in docker-compose](https://docs.opal.ac/getting-started/quickstart/opal-playground/overview)

  

  - [Try the getting started guide for containers](https://docs.opal.ac/getting-started/running-opal/overview)

  



  - [Check out the Helm Chart for Kubernetes](https://github.com/permitio/opal-helm-chart)



- A video demo of OPAL is available [here](https://www.youtube.com/watch?v=IkR6EGY3QfM)



- You can also check out this webinar and Q&A about OPAL [on our YouTube channel](https://www.youtube.com/watch?v=A5adHlkmdC0&t=1s)

  



- 💪   TL;DR - This one command will download and run a working configuration of OPAL server and OPAL client on your machine:



```

curl -L https://raw.githubusercontent.com/permitio/opal/master/docker/docker-compose-example.yml \

> docker-compose.yml && docker-compose up

```





  

    

  




- 🧠   "How-To"s



  - [How to get started with OPAL (Packages and CLI)](https://docs.opal.ac/getting-started/running-opal/as-python-package/overview)



  - [How to get started with OPAL (Container Images)](https://docs.opal.ac/getting-started/running-opal/overview)



  - [How to trigger Data Updates via OPAL](https://docs.opal.ac/tutorials/trigger_data_updates)



  - [How to extend OPAL to fetch data from your sources with FetchProviders](https://docs.opal.ac/tutorials/write_your_own_fetch_provider)



  - [How to configure OPAL (basic concepts)](https://docs.opal.ac/tutorials/configure_opal)



  - [How to Use OPAL with Cedar in a Multi-Language Project](https://www.permit.io/blog/scaling-authorization-with-cedar-and-opal)



- 🎨   [Key concepts and design](https://docs.opal.ac/overview/design)

- 🏗️   [Architecture](https://docs.opal.ac/overview/architecture)






OPAL  uses a client-server stateless architecture. OPAL-Servers publish policy and data updates over a lightweight (websocket) PubSub Channel, which OPAL-clients subscribe to via topics. Upon updates each client fetches data directly (from source) to load it in to its managed OPA instance.

  


simplified




📖   For further reading check out our [Blog](https://bit.ly/opal_blog).



## Community



Come talk to us about OPAL, or authorization in general - we would love to hear from you ❤️



You can raise questions and ask for features to be added to the road-map in our [**Github discussions**](https://github.com/permitio/opal/discussions), report issues in [**Github issues**](https://github.com/permitio/opal/issues), follow us on Twitter to get the latest OPAL updates, and join our Slack community to chat about authorization, open-source, realtime communication, tech, or anything else!



If you are using our project, please consider giving us a ⭐️



[![Button][join-slack-link]][badge-slack-link]  [![Button][follow-twitter-link]][badge-twitter-link]



## Contributing to OPAL



- Pull requests are welcome! (please make sure to include _passing_ tests and docs)

- Prior to submitting a PR - open an issue on GitHub, or make sure your PR addresses an existing issue well.



[join-slack-link]: https://i.ibb.co/wzrGHQL/Group-749.png

[badge-slack-link]: https://io.permit.io/join_community

[follow-twitter-link]: https://i.ibb.co/k4x55Lr/Group-750.png

[badge-twitter-link]: https://twitter.com/opal_ac



## There's more!



- Check out [OPToggles](https://github.com/permitio/OPToggles), which enables you to create user targeted feature flags/toggles based on Open Policy managed authorization rules!

- Check out [Cedar-Agent](https://github.com/permitio/cedar-agent), the easiest way to deploy & run AWS Cedar.