You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/design.md
+6-6
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@
5
5
OPAL is built on the shoulders of open-source giants, including:
6
6
-[Open Policy Agent](https://www.openpolicyagent.org/)- the default policy agent managed by OPAL.
7
7
-[FastAPI](https://github.com/tiangolo/fastapi) - the ASGI API framework used by OPAL-servers and OPAL-clients.
8
-
-[FastAPI Websocket PubSub](https://github.com/authorizon/fastapi_websocket_pubsub) - powering the live realtime update channels
8
+
-[FastAPI Websocket PubSub](https://github.com/permitio/fastapi_websocket_pubsub) - powering the live realtime update channels
9
9
-[Broadcaster](https://pypi.org/project/broadcaster/) allowing syncing server instances through a backend backbone (e.g. Redis, Kafka)
10
10
11
11
## <aname="key-concepts"></a>💡 Key Concepts
@@ -26,13 +26,13 @@ OPAL is built on the shoulders of open-source giants, including:
26
26
## <aname="design"></a> ✏️ Design choices
27
27
28
28
-### Networking
29
-
- OPAL creates a highly efficient communications channel using [websocket Pub/Sub connections](https://github.com/authorizon/fastapi_websocket_pubsub) to subscribe to both data and policy updates. This allows OPAL clients (and the services they support) to be deployed anywhere - in your VPC, at the edge, on-premises, etc.
29
+
- OPAL creates a highly efficient communications channel using [websocket Pub/Sub connections](https://github.com/permitio/fastapi_websocket_pubsub) to subscribe to both data and policy updates. This allows OPAL clients (and the services they support) to be deployed anywhere - in your VPC, at the edge, on-premises, etc.
30
30
- By using **outgoing** websocket connections to establish the Pub/Sub channel most routing/firewall concerns are circumnavigated.
31
31
- Using Websocket connections allows network connections to stay idle most of the time, saving CPU cycles for both clients and servers (especially when comparing to polling-based methods).
32
32
33
33
-### Implementation with Python
34
34
- OPAL is written completely in Python3 using asyncio, FastAPI and Pydantic.
35
-
OPAL was initially created as a component of [**auth**orizon.com](https://www.authorizon.com), and we've chosen Python for development speed, ease of use and extensibility (e.g. fetcher providers).
35
+
OPAL was initially created as a component of [Permit.io](https://www.permit.io), and we've chosen Python for development speed, ease of use and extensibility (e.g. fetcher providers).
36
36
- Python3 with coroutines (Asyncio) and FastAPI has presented [significant improvements for Python server performance](https://www.techempower.com/benchmarks/#section=test&runid=7464e520-0dc2-473d-bd34-dbdfd7e85911&hw=ph&test=composite&a=2&f=zik0zj-qmx0qn-zhwum7-zijx1b-z8kflr-zik0zj-zik0zj-zijunz-zik0zj-zik0zj-zik0zj-1kv). While still not on par with Go or Rust - the results match and in some cases even surpass Node.js.
37
37
38
38
-### Performance
@@ -50,7 +50,7 @@ OPAL is built on the shoulders of open-source giants, including:
50
50
- OPAL was built initially with OPA in mind, and OPA is mostly a first-class citizen in OPAL. That said OPAL can support various and multiple policy agents, even in parallel - allowing developers to choose the best policy agent for their needs.
51
51
52
52
-### <aname="large-scale-fga"></a> FGA, large scale / global authorization (e.g. Google Zanzibar)
53
-
- OPAL is built for fine grained authorizon (FGA), allowing developers to aggregate all and any data they need and restructure it for the authorization layer.
53
+
- OPAL is built for fine grained authorization (FGA), allowing developers to aggregate all and any data they need and restructure it for the authorization layer.
54
54
- OPAL achieves this by making sure each policy-agent is loaded with only the data it needs via topic subscriptions (i.e: data focus and separation).
55
55
- Examples of data separation: the back-office service doesn't need to know about customer users, a tenant specific service doesn't need the user list of other tenants, ...
56
56
- That said OPAL is still limited by OPA's [resource utilization capacity](https://www.openpolicyagent.org/docs/latest/policy-performance/#resource-utilization).
@@ -64,5 +64,5 @@ OPAL is built on the shoulders of open-source giants, including:
64
64
- If you'd like to use OPAL or some of its underlying modules for other update cases - please contact us (See below), we'd love to help you do that.
65
65
66
66
-### Administration capabilities and UI
67
-
- We've already built policy editors, back-office, frontend-embeddable interfaces, and more as part of [**auth**orizon.com](https://www.authorizon.com).
68
-
- We have plans to migrate more parts of [**auth**orizon.com](https://www.authorizon.com) to be open-source; please let us know what you'd like to see next.
67
+
- We've already built policy editors, back-office, frontend-embeddable interfaces, and more as part of [Permit.io](https://permit.io).
68
+
- We have plans to migrate more parts of [Permit.io](https://permit.io) to be open-source; please let us know what you'd like to see next.
# <aname="intro"></a>💡 Introduction to OPAL - data and policy realtime delivery
2
-
- Modern applications are complex, distributed, multi-tenant and run at scale - often creating overwhelming authorization challenges. OPA (Open-Policy-Agent) brings the power of decoupled policy to the infrastructure layer (especially K8s), and light applications. OPAL supercharges OPA to meet the pace of live applications, where the state relevant to authorization decisions may change with every user click and api call.
2
+
Modern applications are complex, distributed, multi-tenant and run at scale - often creating overwhelming authorization challenges.
3
+
4
+
OPA (Open-Policy-Agent) brings the power of decoupled policy to the infrastructure layer (especially K8s), and light applications.
5
+
6
+
OPAL supercharges OPA to meet the pace of live applications, where the state relevant to authorization decisions may change with every user click and api call.
3
7
4
8
- OPAL builds on top of OPA adding realtime updates (via Websocket Pub/Sub) for both policy and data.
5
9
@@ -8,10 +12,10 @@
8
12
### <aname="why-use-opal"></a> Why use OPAL
9
13
- OPAL is the easiest way to keep your solution's authorization layer up-to-date in realtime.
10
14
- OPAL aggregates policy and data from across the field and integrates them seamlessly into the authorization layer.
11
-
- OPAL is microservices and cloud-native (see [key concepts](#key-concepts) below)
15
+
- OPAL is microservices and cloud-native (see [Key concepts and design](design.md))
12
16
13
17
### Why OPA + OPAL == 💪 💜
14
-
OPA (Open Policy Agent) is great! It decouples policy from code in a highly-performant and elegant way. But the challege of keeping policy agents up-to-date is hard - especially in applications - where each user interaction or API call may affect access-control decisions.
18
+
OPA (Open Policy Agent) is great! It decouples policy from code in a highly-performant and elegant way. But the challenge of keeping policy agents up-to-date is hard - especially in applications - where each user interaction or API call may affect access-control decisions.
15
19
OPAL runs in the background, supercharging policy-agents, keeping them in sync with events in realtime.
16
20
17
21
### What OPAL *is not*
@@ -21,13 +25,12 @@ OPAL runs in the background, supercharging policy-agents, keeping them in sync w
21
25
22
26
</br>
23
27
- Large scale Global FGA:
24
-
- Currently OPAL is not meant for managing ridiculous (>100GB) amounts of data within one layer. Though it can complement a CDN to achieve a similar result - [see below](#large-scale-fga).
28
+
- Currently OPAL is not meant for managing ridiculous (>100GB) amounts of data within one layer. Though it can complement a CDN to achieve a similar result - see [Key concepts and design](design.md#"large-scale-fga).
25
29
- Check out <ahref="https://research.google/pubs/pub48190/"target="_blank">Google-Zanzibar</a>
26
30
27
31
</br>
28
32
- Fullstack authorization:
29
33
- OPAL and OPA essentially provide microservices for authorization
30
34
- Developers still need to add control interfaces on top (e.g. user-management, api-key-management, audit, impersonation, invites) both as APIs and UIs
31
-
- Check out <ahref="https://authorizon.com"target="_blank">**auth**orizon</a>
32
-
35
+
- Check out <ahref="https://permit.io"target="_blank">Permit.io</a>
0 commit comments