Building fine-grained access controls into your open source project is a difficult challenge.

We can reduce and amortize this challenge by centralizing the complexity in a general-purpose authorization engine. Before Kubernetes, everyone built stacks from the ground up. With Kubernetes, distributed systems complexity is centralized and shared by the community, saving everyone time and effort.

Cedar Policy, a recently-donated CNCF Sandbox project, aims to remove the heavy lifting of implementing access control. Cedar supports role-, relation-, and attribute-based access control paradigms. It can be embedded into any application or run as a service. It has a flexible, typed schema that enables a tight feedback loop in your IDE. Uniquely, Cedar policies are analyzable, allowing answering questions like “is the refactored policy equal to the previous one?” or "who has access to this resource?"

This talk introduces Cedar and presents a case study on how it can be used to make Kubernetes access control more fine-grained, expressive and understandable.