OPAã¯ãµãŒãã¹ããœãããŠã§ã¢ã®æææ±ºå®æ©èœãæ¬äœãšåé¢ããããã«äœããããšã³ãžã³ã§ããããã§èšããæææ±ºå®ããšã¯ããããèªå¯ã®è©±ã ãã§ã¯ãªããæ§ã ãªããšã«å¿çšã§ããŸãã
- Infrastructure as Code ã§èšè¿°ãããèšå®ã«å±éºãªæ§æïŒäŸãã°ã¢ã¯ã»ã¹å¶åŸ¡ãé©åã§ãªãïŒã®ãã§ãã¯
- ãããã€ããããªãœãŒã¹ãããªã·ãŒã«æºæ ããèšå®ã»æ§æã«ãªã£ãŠãããã®ãã§ãã¯
- ã»ãã¥ãªãã£ã¹ãã£ã³ã§æ€åºãããçµæã«å¯ŸããŠãç¬èªã®æ·±å»åºŠãå€å®ãã
- WebãµãŒãã¹ãªã©ã§ãã©ã®ããŒã«ã®ãŠãŒã¶ãã©ã®ãªãœãŒã¹ã«ã¢ã¯ã»ã¹ã§ãããå€å®ãã
- äœæãããªãœãŒã¹ã®çš®é¡ãèšå®ãææè ãªã©ã®ã¡ã¿æ å ±ããããªãœãŒã¹ã®éèŠåºŠãå€å®ãã
äžèšã®éããããã²ãšãããŸãã®å ¥åããŒã¿ã«å¯ŸããŠã1ã€ã®å€æçµæãåºåããããšãããããªã·ã³ãã«ãªå€å®åŠçã§ããã°ã»ãšãã©ã®ãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããŸããæ å ±ã»ãã¥ãªãã£ä»¥å€ã®åéã«ãå©çšã§ãããšæããŸããããããã£ãã倿ããæ å ±ã»ãã¥ãªãã£ã®åéã§ããæ±ããããããããã®é åã§æ³šç®ãããŠããŸãã
éã«ã€ã³ã¿ã©ã¯ãã£ãããããšããçºçãããããªåŠçããç¶æ ãç¶æããªããåŠçãããªã©ã¯OPAã®èŠæãšããé åã§ãããäžè¬çãªæç¶ãåããã°ã©ãã³ã°èšèªãçšããŠå®çŸããã»ããè¯ãã§ãã
å ·äœçãªæ©èœ
OPAãã§ããããšã¯ãšãŠãã·ã³ãã«ã§ããäºåã«çšæãããããªã·ãŒããã³ããŒã¿ãå ã«ãåãåã£ãã¯ãšãªããäœããã®å€å®çµæãåºåããããšããã®ãäž»ãªæ©èœã«ãªããŸããå€å®çµæã¯OK/NGã®ãããª2å€ã§ã¯ãªããæååãæ°å€ãããã«æ§é åããŒã¿ãåºåããããšãã§ããŸãã
- ã¯ãšãª: å€å®çµæãæ±ããããã«éœåºŠç°ãªãæ å ±ããã¯ãšãªããšããŠOPAã«å ¥åããŸããå ·äœçã«ã¯ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ã«é¢ãããªã¯ãšã¹ããèšå®äžåã®ãã§ãã¯ããããèšå®ã®ããŒã¿ãªã©ã«ãªããŸããèªç±ãªã¹ããŒãã®JSONã§å ¥åããããšãã§ããŸãã
- ããªã·ãŒ: Regoã§èšè¿°ãããå€å®çµæãå°ãããã®ããžãã¯ã§ãã
- ããŒã¿ïŒä»»æïŒ: éœåºŠå€æŽããããã®ã§ã¯ãªããå€å®ããããã«å¿ èŠãªæ å ±ã«ãªããŸããäŸãã°IPã¢ãã¬ã¹ããŠãŒã¶IDããŸãšããèš±å¯ãªã¹ãã®ãããªãã®ã«ãªããŸãã
- å€å®çµæïŒã¯ãšãªãããªã·ãŒã«åŸã£ãŠåŠçãããçµæãåºåãããŸããã¹ããŒãã¯ããªã·ãŒã®å 容ã«äŸåããŸãã
ãããä¹±æŽã«èª¬æãããšããããªã·ãŒïŒRegoïŒã«åŸã£ãŠå ¥åãããJSONãå¥ã®JSONã§åºåããããã®ãšã³ãžã³ããšçè§£ããŠããããã°ãšæããŸãããã®èªç±ãªå ¥åãšåºåãã§ããããšã§ãOPAãæ±çšçãªããªã·ãŒãšã³ãžã³ãšããŠå©çšããããšãã§ããŸãã
OPAãäœ¿ãæ¹æ³ã¯ããã€ãçšæãããŠããã倧ãã以äžã®3ã€ã«åé¡ã§ããŸãã
-
opa
ã³ãã³ãã«ãã£ãŠã¯ãšãªãæå®ããŠè©äŸ¡ããå€å®çµæãCLIã§åºåãã -
opa
ã³ãã³ãã«ãã£ãŠHTTPãµãŒããèµ·åããã¯ãšãªãHTTPã§éä¿¡ã»å€å®çµæãåä¿¡ãã -
github.com/open-policy-agent/opa/rego
ããã±ãŒãžã䜿ã£ãèªäœã®Goããã°ã©ã ã䜿ã
詳ããã¯ä»åŸã®èšäºã§ç޹ä»ããŠãããŸãããç¶æ³ã«åãããŠæè»ã«å©çšããããšãã§ããŸããéã«èšããšOPAãåç¬ã§å©çšãããšãããŠãŒã¹ã±ãŒã¹ã¯ããŸãèãããããåºæ¬çã«ã¯ãªãããã®å®è£ ãšé£æºãããŠå©çšãã圢ã«ãªããŸãã
Regoã«ããããªã·ãŒèšè¿°ã®å ·äœäŸ
ã·ã³ãã«ãªäŸãšããŠãããŒã«ã« admin
ãå
¥ã£ãŠããã allow = true
ãè¿ãããšããããªã·ãŒã以äžã«ç€ºããŸããïŒplayground ã§å®éã«å®è¡ããããšãã§ããŸãïŒ
ããªã·ãŒ
default allow = false
allow {
input.roles[_] == "admin"
}
ã¯ãšãª
{
"user": "m-mizutani",
"roles": ["admin", "developer"]
}
å€å®çµæ
{
"allow": true
}
ãã®äŸã¯éåžžã«ã·ã³ãã«ã§ãããäŸãã°ããã«å ããŠãã©ã®çš®é¡ã®ãªãœãŒã¹ã«ã¢ã¯ã»ã¹ããŠãããããã©ã®ãããªæäœãããããšããŠãããããæå±ããŠããã°ã«ãŒãã«ã©ã®ãããªæš©éãä»äžãããŠãããããªã©ã®é ç®ãèŠããããªããžãã¯ã远å ã§ããŸãããã¡ãã詳ããã¯ä»åŸã®èšäºã§ç޹ä»ããŠãããããšæããŸãã
OPAã»Regoã䜿ãã¡ãªããã»ãã¡ãªãã
OPAã»Regoã¯äŸ¿å©ãªããŒã«ã§ã¯ãããŸããããã¯ãã¡ãªããã»ãã¡ãªããã¯ããããå©çšããå Žé¢ã¯éžã¶å¿ èŠããããšæããŸããçè ãçŸç¶æããŠããã¡ãªããã»ãã¡ãªãããç°¡åã«ç޹ä»ããŸãã
ã¡ãªãã
- ããªã·ãŒãšå®è£ ãåé¢ã§ãã: å®è£ ã«çµã¿èŸŒãå Žåã§ããµãŒããšããŠå®è¡ããå Žåã§ããããªã·ãŒãšå®è£ ãåããå Žæã§ç®¡çã§ããŸããå€ãã®ãœãããŠã§ã¢ã§ã¯ããªã·ãŒãå®è£ ã«ããŒãã³ãŒãã£ã³ã°ã§åã蟌ãŸããŠããããã®å Žåã¯ããªã·ãŒã倿Žããããã«ãœãããŠã§ã¢ãåãããã€ããå¿ èŠããããŸããããªã·ãŒãåé¢ããŠããããšã§å®è£ å šäœã®åãããã€ã¯ãããããªã·ãŒãæäŸããOPAãµãŒããå®è£ ãåç §ããããªã·ãŒã ããæŽæ°ããããšã§ãéçšã楜ã«ãªãã±ãŒã¹ããããšæåŸ ãããŸãããŸããããªã·ãŒã®å®è¡ç°å¢ãsandboxåããããããããªã·ãŒå€æŽã«ãã£ãŠããªã·ãŒã«é¢ä¿ããªãç®æã«ãŸã§ç Žå£çãªåœ±é¿ãåãŒãå¯èœæ§ãå°ãªããªãããšããã¡ãªããããããŸãã
- æææ±ºå®ã«å¿ èŠãªæ©èœã ããæäŸãããŠãã: Regoã端çã«èª¬æãããšãäžè¬çãªããã°ã©ãã³ã°èšèªã®ãµãã»ããããããã¯äžäœäºæããšãªããŸããå ¥åãããã¯ãšãªã«å¯ŸããŠå€å®ãããããžãã¯ãèšè¿°ããããã®æ©èœã«ç¹åããŠ[1]ãããããã«ãã£ãŠèšè¿°æ¹æ³ãéå®ãããŠæžãæ¹ãããçšåºŠã¯äžå®ã«ãªã£ãããå€å®ããžãã¯å ã«ã·ã¹ãã å šäœãžåœ±é¿ãããè匱æ§ãå ¥ã蟌ã¿ã«ãããªãããšãã广ãæåŸ ã§ããŸãã
- èªåã§ããªã·ãŒãšã³ãžã³ãå®è£ ããªããŠè¯ã: èªåãäœã£ããœãããŠã§ã¢ã«äœããèªç±åºŠã®ããå€å®ã«ãŒã«ãããããå Žåããšã³ãžã³ãå®è£ ãã€ã€ãããæ£ããåäœããããæ€èšŒãç¶ããå¿ èŠããããŸãããããäžå®ä¿¡é Œã§ããå€éšã¢ãžã¥ãŒã«ã«å§èšããããšã§ãé¢é£ããå®è£ ãçšæããå¿ èŠããªããªããéçºè ãæ¬åœã«ããã¹ãæ©èœã«éäžã§ããŸã
ãã¡ãªãã
- Regoã®åŠç¿ã³ã¹ããé«ã: Regoã¯prologã®ç³»èãæã€å®£èšåããã°ã©ãã³ã°èšèªã«ãªããŸãã仿¥ãåºã䜿ãããŠããããã°ã©ãã³ã°èšèªã¯å€§éšåãæç¶ãåèšèªã§ãããæç¶ãåã®ã¿ã«æ £ããŠããéçºè ã«ãšã£ãŠå®£èšåã®ããã°ã©ã ãç¿åŸããããã«ã¯äžå®ã³ã¹ããé«ããªã£ãŠããŸããã¡ã§ããããšãã課é¡ã¯æèããå¿ èŠããããŸãã
- ããªã·ãŒãšå®è£ ãççµåããã®ãã¹ãèµ·ãããã: ããªã·ãŒãççµåã«ããããšã§ãµãŒãã¹ã®ãããã€ãšã®äŸåé¢ä¿ã匱ããããšãã§ããŸãããäžæ¹ã§å®è£ ãšåæããšããã«æå³ãã¬å€å®çµæãåºåããŠããŸããšããããšãèµ·ããããŸããäŸãã°æ°ããçš®é¡ã®ããŒã«ãå®è£ ã«è¿œå ããŠããªãã®ã«ããªã·ãŒåŽã«ãã®ããŒã«ã«é¢ããèšè¿°ããªããšäºæãã¬èš±å¯ã»æåŠãçºçãããå¯èœæ§ããããŸããããã¯å®è£ ã®å·¥å€«ãªã©ã§äžå®åé¿ã§ããŸãããå®è£ ãšããªã·ãŒã®æŽåã¯åžžã«æ°ãé ãå¿ èŠããããŸãã
ãŸãšã
OPA/Regoã¯æ±çšæ§ãé«ãæ§ã ãªå Žé¢ã§å©çšã§ããŸãããäžåŸæãšããå Žé¢ãä»ã®åŠçç³»ã䜿ã£ãã»ããããå Žé¢ãåœç¶ãªãããããŸããããããOPA/Regoã§å ·äœçã«ã©ã®ãããªããšãã§ããã©ã®ãããªãŠãŒã¹ã±ãŒã¹ã«åºããã®ãããšããããšã玹ä»ããŠãããã°ãšæããŸãã
-
å®ã¯httpãªã¯ãšã¹ããéä¿¡ããæ©èœããã£ããã¯ããã®ã§ãå®å šã«å€éšã«åœ±é¿ãåãŒããªãããšã¯ä¿èšŒã§ããŸããã â©ïž