ladon VS topaz

4. OPA evaluates the policies written in Rego against the input and returns a decision (allow or deny) back to your service.

What's good solid alternatives in Kubernets? Saw CASBIN, paid services, but nothing close to OPA/Rego. Please correct me if I'm wrong.

I found it's hard to convince everyone around to use OPA/Rego and wrap into a managed service. The main objection - wrapping another DSL (domain-specific language) is hard.

However it was relatively simple to convince my team to use featured complete Go library Ladon https://github.com/ory/ladon

Ladon is inspired by AWS IAM Policies.

{

OPA is a great tool for implementing a policy-as-code system. But if you're trying to use it for application authorization (e.g. fine-grained authz for B2B SaaS or a set of internal applications), you may find that its policy story is strong, but it doesn't really have a "data plane": you either store data in a data.json file and rebuild the policy any time that data changes, or make an http.send call out of the policy to fetch dynamic data.

Check out Topaz [0], which uses OPA as its decision engine, but adds a data plane that is based on the ReBAC ideas explored in the Google Zanzibar [1] paper.

Disclaimer: I work on the team [2] that builds and maintains the Topaz project.

[0] https://www.topaz.sh

[1] https://research.google/pubs/zanzibar-googles-consistent-glo...

[2] https://www.aserto.com

You can, simply use the topazd.exe binary from the topaz_windows_x86_64.zip from the GH releases page (https://github.com/aserto-dev/topaz/releases). Note this is currently not a Windows Service, so not net start topaz. Let me know if that would be interesting.

Topaz is an open-source authorization project for cloud-native applications. It uses OPA as the decision engine and supports Rego policy as first-class citizens. It also has an embedded relationship database to support data-centric authorization models like Google Zanzibar's relationship-based access controls (ReBAC).