3 ms·

This solution seems comparable to running Envoy Proxy as a reverse / frontend proxy with a JWT filter. Would you say that's a fair comparison? What would you sa

This solution seems comparable to running Envoy Proxy as a reverse / frontend proxy with a JWT filter. Would you say that's a fair comparison? What would you say are the benefits of using this over such an Envoy setup with Envoy becoming so popular? Super excited to see more players move in this space btw!

ibuildoss 8y ago
I have not used envoy extensively yet, but there are obviously many more options such as Apache2 + mod_oidc, Kong + oauth2 plugin, and so on. The main differentiator is that Oathkeeper is capable of performing more sophisticated permission checks (think RBAC / AWS IAM Policies) and is specifically geared towards solving authentication and authorization in front of "your" service. Most other implementations I saw (and I think this also goes a bit for envoy) is that they solve access control as one of the things in the feature set, while also focusing strongly on routing, load balancing, and other typical API gateway issues. We're explicitly not trying to build another API gateway but instead something that you deploy alongside your existing API gateway (or maybe as a sidecar) with the sole purpose of checking answering: "is the request that's coming through really allowed to perform that action?". Hope this clarifies it, if not I'm more than happy to go into more detail :)
joeyspn 8y ago
Seems like you are describing Ambassador here [0]. I think this could play nice as Ambassador's external auth service [1]. Oathkeeper looks very interesting... Congrats and best of luck! [0] https://www.getambassador.io https://www.getambassador.io [1] https://www.getambassador.io/reference/services/auth-service https://www.getambassador.io/reference/services/auth-service
- ibuildoss 8y ago
  Nice, I have heard about Ambassador before but did not have the time to look into it in detail. It is just amazing how much OSS is being created around the k8s/container ecosystem and I truly believe that it will greatly improve our lives as developers in the future. I've added this to our internal list and we will check it out and see if any synergies are possible with our products. Our vision is that these services work so well and easy with the rest of the ecosystem, that you can get started with a new project in a day or two and have everything set up - from users, to permissions, to routing (e.g. via ambassador), to testing (there's still ton of space for this), and so on. I think the journey of software development beyond 2020 will be very exciting! ps: Sorry for slow responses, HN has a very high post wait time once you hit the limit. And thank you for the positive vibes :)
  - joeyspn 8y ago
    I was just speaking with Datawire/Ambassador CEO in their slack about Oathkeeper... you should reach out and speak with them. Interesting synergies IMO.
    - ibuildoss 8y ago
      Awesome, following up in their slack :)
  - dankohn1 8y ago
    Check out CNCF's Interactive Landscape to keep track of the ecosystem: https://l.cncf.io https://l.cncf.io
    - ibuildoss 8y ago
      That's an awesome list, thank you!

ibuildoss 8y ago

I have not used envoy extensively yet, but there are obviously many more options such as Apache2 + mod_oidc, Kong + oauth2 plugin, and so on. The main differentiator is that Oathkeeper is capable of performing more sophisticated permission checks (think RBAC / AWS IAM Policies) and is specifically geared towards solving authentication and authorization in front of "your" service. Most other implementations I saw (and I think this also goes a bit for envoy) is that they solve access control as one of the things in the feature set, while also focusing strongly on routing, load balancing, and other typical API gateway issues. We're explicitly not trying to build another API gateway but instead something that you deploy alongside your existing API gateway (or maybe as a sidecar) with the sole purpose of checking answering: "is the request that's coming through really allowed to perform that action?". Hope this clarifies it, if not I'm more than happy to go into more detail :)

joeyspn 8y ago

Seems like you are describing Ambassador here [0]. I think this could play nice as Ambassador's external auth service [1]. Oathkeeper looks very interesting... Congrats and best of luck! [0] https://www.getambassador.io https://www.getambassador.io [1] https://www.getambassador.io/reference/services/auth-service https://www.getambassador.io/reference/services/auth-service

ibuildoss 8y ago
Nice, I have heard about Ambassador before but did not have the time to look into it in detail. It is just amazing how much OSS is being created around the k8s/container ecosystem and I truly believe that it will greatly improve our lives as developers in the future. I've added this to our internal list and we will check it out and see if any synergies are possible with our products. Our vision is that these services work so well and easy with the rest of the ecosystem, that you can get started with a new project in a day or two and have everything set up - from users, to permissions, to routing (e.g. via ambassador), to testing (there's still ton of space for this), and so on. I think the journey of software development beyond 2020 will be very exciting! ps: Sorry for slow responses, HN has a very high post wait time once you hit the limit. And thank you for the positive vibes :)
- joeyspn 8y ago
  I was just speaking with Datawire/Ambassador CEO in their slack about Oathkeeper... you should reach out and speak with them. Interesting synergies IMO.
  - ibuildoss 8y ago
    Awesome, following up in their slack :)
- dankohn1 8y ago
  Check out CNCF's Interactive Landscape to keep track of the ecosystem: https://l.cncf.io https://l.cncf.io
  - ibuildoss 8y ago
    That's an awesome list, thank you!