What is OPA?

An open source, general purpose policy engine. A graduated project in CNCF (Cloud Native Computing Foundation). 

Uses a high-level language that lets users specify a policy as code and simple APIs for policy decision making.

Written in Go. Or Rego, which is OPAs policy language. https://pkg.go.dev/github.com/open-policy-agent/opa/rego

Experimentation:

Approach 1: OPA with Java Sidecar

Develop a Java sidecar to seamlessly integrate with Open Policy Agent (OPA) for dynamic policy enforcement within Java-based applications.

The proposed Java sidecar will be developed using standard Java libraries and frameworks, with consideration for ease of use and minimal impact on existing applications. It will be designed to support Java applications running in various environments, including cloud-native architectures.

• • Utilize HTTP REST APIs for secure communication with OPA.

  • Implement Java HTTP clients to send policy queries and receive decisions from OPA.

• • Design a simple and intuitive Java API for defining and enforcing policies.

  • Convert Java application context into OPA-compatible data structures for policy evaluation.

  • Implement a mechanism for dynamically updating policies from OPA.

  • Support real-time updates.

  • Integrate with Kafka for asynchronous communication with other components of the system.

  • Implement Kafka producers or consumers as necessary for policy-related events.

Approach 2: PDP with OPA lib

Develop a Go application that seamlessly integrates with Open Policy Agent (OPA), leveraging the OPA Rego language, and incorporates Kafka for event-driven communication.

• • Use the OPA Rego library to integrate OPA into the Go application.

  • Establish a secure communication channel between the Go application and OPA.

• • Develop a clear and concise mechanism for defining policies using the OPA Rego language within the Go application.

  • Implement logic for evaluating policies using the OPA Rego engine.

• • Enable the Go application to dynamically load and update policies from OPA for real-time adjustments.

• • Implement Kafka producers to publish policy-related events when policy decisions are made.

  • Implement Kafka consumers to listen for policy-related events and trigger appropriate actions.

Conclusion: Both approaches involve integrating OPA for policy enforcement, with the second approach additionally incorporating Kafka for event-driven communication. The choice between a Java sidecar and a Go application is yet to be decided.