OpenShift Reference Architecture for Policy Management

This white paper presents the OpenShift Reference Architecture, focusing on the implementation of admission control and application communication authorization using Styra Declarative Authorization Service (DAS), Styra Load, and Open Policy Agent (OPA). It outlines the key architectural components necessary for making authorization decisions and managing policies in heterogeneous environments. The document details the roles of Policy Enforcement Points (PEP) and Policy Decision Points (PDP), explaining how OPA can be utilized for Kubernetes admission control and service mesh traffic authorization. Additionally, it describes the functionalities of Styra DAS as a central control plane for managing policies across various systems, including Kubernetes and HTTP APIs. The paper also covers deployment methods for OPA and Styra Load agents within OpenShift clusters, detailing the components involved and the process for creating policy bundles. Use cases for OpenShift, including multi-cluster deployment with Red Hat Advanced Cluster Management (RACM), are also discussed, providing a comprehensive guide for architects and administrators.