Open Source Summit + Embedded Linux Conference + OSPOCon 2021

Managing user access could be hard. Previously, Ninja Van adopted a typical RBAC (Role-based access control) approach and applied it to the application layer. The permissions required for accessing endpoints are only available in the code itself. It’s difficult for engineers to get the whole picture of the permissions required for a service/endpoint, and it’s even more difficult for non-technical users to understand our system. What’s worse, the account managers have to guess the permissions behind the name and often end up granting undesirable permissions, which compromises the overall system security. Mengnan introduced a new authorization flow leveraging the power of Kubernetes, Istio and OPA (Open Policy agent). The OPA is deployed as a sidecar, resides side by side with the Envoy proxy. Envoy talks to OPA via the external authorization interface to evaluate all the incoming requests. The access policy is defined as Kubernetes CRD, managed by our in-house Kubernetes operator and then distributed to all the OPA sidecars. The distributed authorization approach eliminates the single point of failure, extracts the access control out of code and integrates it with CI/CD pipeline. Furthermore, the user access can be shown as an interactive tree now ;)