SK Planet Simplifies JIRA Permission Logic with OPA Sidecar

SK Planet introduced Open Policy Agent (OPA) for permission management in its internal ITSM system. While keeping the existing JIRA data structure, it separated out the permission check logic and implemented it as Rego policies.

OPA-Based Permission Handling Structure

Permission data is stored in a DB column in JSON form, and OPA loads it into memory to execute. The Rego policy sets the default to deny, and determines permission by checking the roles and groups the user belongs to. On the backend, the @PreAuthorize tag from Spring Security is used to call OPA's data API.

Sidecar Deployment and Performance Benefits

The application and the OPA server were deployed as a sidecar within a single Kubernetes Pod. This allows permission checks to be performed via localhost:8181, eliminating network latency. It also reduced the burden of complex schema design and index optimization that would be required when implementing this directly in Java.

Data Synchronization Challenges

With the sidecar approach, data modifications require separate requests to each OPA server. To address this, the team is reviewing options such as event-based updates via a message broker or policy and data synchronization using OPAL.