OPA as authorization webhook for Kubernetes

[Blarc]

Hi,

I am trying to setup OPA as authorization webhook on minikube (for now) and I'm running into a lot of issues, since the examples that I found seem to be outdated. The repository, that is linked on the OPA ecosystem page, uses an old version of OPA (openpolicyagent/opa:0.26.0-rootless).

So I've tried to combine the knowledge from the OPA Ingress Validation tutorial and kubernetes authorization webhook documentation. I've managed to deploy OPA and redirect the authorization requests to it. I can see in the logs, that OPA receives the requests:

{
  "client_addr": "10.244.0.1:64253",
  "level": "info",
  "msg": "Received request.",
  "req_body": "{\"kind\":\"SubjectAccessReview\",\"apiVersion\":\"authorization.k8s.io/v1\",\"metadata\":{\"creationTimestamp\":null},\"spec\":{\"resourceAttributes\":{\"namespace\":\"opa\",\"verb\":\"list\",\"version\":\"v1\",\"resource\":\"pods\"},\"user\":\"opa\",\"groups\":[\"system:authenticated\",\"devops\"]},\"status\":{\"allowed\":false}}\n",
  "req_id": 583,
  "req_method": "POST",
  "req_params": {
    "timeout": [
      "30s"
    ]
  },
  "req_path": "/v1/data/k8s/authz/decision",
  "time": "2025-03-05T07:00:04Z"
}

but the problem is that Kubernetes does not wrap the request into input attribute as OPA expects it and the requests fails:

{
  "client_addr": "10.244.0.1:64253",
  "level": "info",
  "msg": "Sent response.",
  "req_id": 583,
  "req_method": "POST",
  "req_path": "/v1/data/k8s/authz/decision",
  "resp_body": "{\"decision_id\":\"259b2b32-25aa-4a4e-9199-b24c5cde73ab\",\"warning\":{\"code\":\"api_usage_warning\",\"message\":\"'input' key missing from the request\"}}\n",
  "resp_bytes": 143,
  "resp_duration": 2.036899,
  "resp_status": 200,
  "time": "2025-03-05T07:00:04Z"
}

Is there a way, to tell OPA to not look for the input field? The only solution I see at the moment, is to create a side-container that proxies the requests and wraps them into input field.

[anderseknert]

Yes, just replace “v1” in the path with “v0” 🙂

[Blarc]

Is there an API documentation for v0 ? I've tried doing this before, but it didn't work. I might have messed something up, though.

[Blarc]

For example, curl -k https://10.96.167.0/v0/policies returns 404 page not found, that's why I assumed it doesn't work, but I guess I was wrong?

[Blarc]

Aha, I guess that path /policies only exists for v1. I'll try to update the webhook configuration and let's see what happens.

[Blarc]

Huh, now it works, thanks.

For anyone that might have similar problems, here are my files:
api-server/webhook.yaml

clusters:
- name: opa
  cluster:
    # For the purpose of the demo we use a self-signed certificate.
    # This should obviously be changed for production purposes.
    insecure-skip-tls-verify: true
    # Use static IP configured for service as the kubernetes DNS service (CoreDNS)
    # can't be used by the API server (as that would be a circular dependency).
    server: https://10.96.167.0/v0/data/k8s/authz/decision
users:
- name: api-server
  user:
    # Authentication method to use for accessing OPA itself
    # See https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization
    token: test-token
current-context: webhook
contexts:
- context:
    cluster: opa
    user: api-server
  name: webhook

kubernetes/resources.yaml

kind: Service
apiVersion: v1
metadata:
  name: opa
  namespace: opa
spec:
  selector:
    app: opa
  clusterIP: 10.96.167.0
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: opa
  namespace: opa
  name: opa
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opa
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
        # WARNING: OPA is NOT running with an authorization policy configured. This
        # means that clients can read and write policies in OPA. If you are
        # deploying OPA in an insecure environment, be sure to configure
        # authentication and authorization on the daemon. See the Security page for
        # details: https://www.openpolicyagent.org/docs/security.html.
        - name: opa
          image: openpolicyagent/opa:1.2.0
          args:
            - "run"
            - "--server"
            - "--tls-cert-file=/certs/tls.crt"
            - "--tls-private-key-file=/certs/tls.key"
            - "--addr=0.0.0.0:8443"
            - "--addr=http://127.0.0.1:8181"
            #            - "--set=services.default.url=http://host.minikube.internal:8888"
            #            - "--set=bundles.default.resource=bundle.tar.gz"
            - "--log-level=debug"
            - "--log-format=json-pretty"
            - "--set=status.console=true"
            - "--set=decision_logs.console=true"
            - "/policy/"
          volumeMounts:
            - readOnly: true
              mountPath: /certs
              name: opa-server
            - mountPath: /policy
              name: policy-volume
          readinessProbe:
            httpGet:
              path: /health?plugins&bundle
              scheme: HTTPS
              port: 8443
            initialDelaySeconds: 3
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /health
              scheme: HTTPS
              port: 8443
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
        - name: opa-server
          secret:
            secretName: opa-server
        - name: policy-volume
          configMap:
            name: opa-k8s-authz-policy

policy/policy.rego

package k8s.authz

import rego.v1

deny contains reason if {
	input.spec.resourceAttributes.namespace == "kube-system"

	reason := "OPA: denied access to namespace kube-system"
}

deny contains reason if {
	input.spec.resourceAttributes.namespace == "opa"

	required_groups := {"system:authenticated", "devops"}
	provided_groups := {group | some group in input.spec[groups]}

	count(required_groups & provided_groups) != count(required_groups)

	reason := sprintf("OPA: provided groups (%v) does not include all required groups: (%v)", [
		concat(", ", provided_groups),
		concat(", ", required_groups),
	])
}

decision := {
	"apiVersion": input.apiVersion,
	"kind": "SubjectAccessReview",
	"status": {
		"allowed": count(deny) == 0,
		"reason": concat(" | ", deny),
	},
}

# Take into account the typo of missing "s" in groups
# in v1beta1 version (which is used by default)
# https://github.com/kubernetes/kubernetes/issues/32709
groups := {
	"authorization.k8s.io/v1": "groups",
	"authorization.k8s.io/v1beta1": "group",
}[input.apiVersion]

kustomization.yaml

resources:
- kubernetes/resources.yaml

configMapGenerator:
- name: opa-k8s-authz-policy
  namespace: opa
  options:
    labels:
      openpolicyagent.org/policy: rego
  files:
  - policy/policy.rego

setup-minikube.sh

#!/usr/bin/env bash

k() {
    kubectl --context opa-authorizer "$@"
}

cp ./api-server/authz-webhook.yaml $HOME/.minikube/files/var/lib/minikube/certs/authz-webhook.yaml
minikube start --profile opa-authorizer \
          --alsologtostderr \
          --v=5 \
          --extra-config apiserver.authorization-webhook-version=v1 \
          --extra-config apiserver.authorization-mode=Node,RBAC,Webhook \
          --extra-config apiserver.authorization-webhook-config-file=/var/lib/minikube/certs/authz-webhook.yaml


k create namespace opa
# to create certs follow https://www.openpolicyagent.org/docs/latest/kubernetes-tutorial/#3-create-tls-credentials-for-opa
k create secret tls opa-server --cert=kubernetes/server.crt --key=kubernetes/server.key --namespace opa
k apply --namespace opa -k .

[anderseknert]

Happy to hear that!

Is there an API documentation for v0?

All the endpoints are documented here.