Embedded Open Policy Agent in Data Plane Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and scaling multiple APIs in microservices architecture is challenging due to duplication of efforts and code, especially when dealing with tens of thousands of APIs and millions of clients, as each API handles its own functionalities individually, leading to inefficiency and complexity in visualization and maintenance.
Innovation Solution
Implementing a distributed API gateway architecture with embedded Open Policy Agent (OPA) in the data plane proxy, which bundles common functionalities like authentication, rate limiting, caching, and logging into a gateway node, allowing for standardized authentication and authorization rules across workloads, and eliminating the need for additional OPA sidecars.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If each API handles its own functionalities individually, then each API can be configured independently, but it leads to duplication of efforts and code, making management and scaling challenging
Solution Approach 1:
The patent combines multiple individual API configurations into a unified API gateway that handles authentication, rate limiting, caching, and logging centrally. This merging eliminates code duplication while maintaining the ability to configure different policies for different APIs through a single standardized interface.
Solution Approach 2:
The API gateway implements universal functionality that serves multiple APIs simultaneously. It provides common services like authentication, rate limiting, and caching that can be applied across numerous APIs with a single configuration framework, reducing overall system complexity while preserving adaptability.
2Adaptability or versatility
If multiple APIs are deployed with individual configurations, then each API can be customized, but it becomes time-consuming to set up and maintain, especially with tens of thousands of APIs
Solution Approach 1:
The API gateway provides universal configuration mechanisms that can be applied across thousands of APIs simultaneously. Administrators can define policies once at the gateway level and have them automatically applied to multiple APIs, dramatically reducing setup and maintenance time while preserving the ability to customize individual API behaviors when needed.
3Use of energy by moving object
If individual servers host multiple APIs, then resource utilization can be optimized, but it becomes difficult to build new APIs and scale existing ones
Solution Approach 1:
The patent segments the API hosting architecture by introducing an API gateway layer that sits in front of individual microservice instances. This segmentation allows servers to be optimized for specific microservices while the gateway handles cross-API functionalities, making it easier to deploy new APIs and scale individual services independently without reconfiguring entire server infrastructures.
4Adaptability or versatility
If each API is configured individually, then specific functionalities can be tuned, but visualization and monitoring of tens of thousands of APIs becomes tedious and cumbersome
Solution Approach 1:
The API gateway acts as an intermediary between individual APIs and monitoring systems. It provides centralized logging, rate limiting, and authentication that can be observed through a single monitoring interface, while still allowing individual API functionalities to be customized. This intermediary layer simplifies visualization by aggregating data from thousands of APIs into unified metrics and logs.
Data Source
AI summary
Disclosed embodiments are directed to a data plane proxy with an embedded open policy agent for a microservices application. An example method for authorizing requests in the microservices application that includes multiple services, each service being an application program interface (API) performing a piecemeal function of an overall application function, includes receiving, by a service of the multiple services, a request for access or utilization of the service. The service includes a data plane proxy that is configured to perform at least one of routing, load balancing, authentication and authorization, service discovery, or health checking for the service. The method further includes determining, by an open policy agent module embedded in the data plane proxy, whether to authorize the request, and transmitting, based on the determining, a decision that authorizes or rejects the request.