Skip to main content

Overview

The DAS Istio system type helps you manage the ingress and egress network traffic permitted within your OPA-integrated Istio service mesh. For example, permit egress traffic only to a predefined collection of endpoints, to minimize the risk of data exfiltration, and implement microservice API authorization.

istio-opa-das-ingress

Figure 1: Istio Architecture for Ingress traffic

istio-opa-das-egress

Figure 2: Istio Architecture for Egress traffic

For more information on how OPA embedded in Istio data plane can be used as an authorization service to enforce security policies over API requests received by Istio, see the Istio tutorial.