>> From theCUBE studios in Palo Alto and Boston,
connecting with thought leaders all around the world,
this is a CUBE conversation.
>> Hi, and welcome to another CUBE Conversation.
I'm Stu Miniman coming to you from our Boston area office.
We've been in the cloud native ecosystem for many years.
We know many open source projects,
really helping to drive innovation,
help companies modernize what they're doing.
And one of the companies that leads
one of those initiatives,
happy to welcome to the program,
we're going to be talking to the co-founder
and CTO of Styra, that is Tim Hinrichs.
First time on theCUBE, of course, company behind OPA.
Tim, thank you for joining us.
Welcome to the program.
>> Hi Stu, thanks for having me.
>> All right, so we've had the CEO of Styra,
Bill Mann, on the program before,
he's many time CUBE alum, it's your first time,
and I always love when I get the founder on the program.
Of course the question is, give us the why Tim.
There's no shortage of tools out there in the industry,
but as we've seen in the ecosystem,
there's always companies, I wish something could happen,
I wish we had something there.
Often they've built it for themselves,
and then, create a project.
So bring us back a little bit to that origin story
and what you and the team, what was the inspiration?
>> So when we...
the first thing to know is that really at Styra
what we're focused on is helping enterprises
that are embracing cloud native technology,
sort of enforce and control the authorization policies
across all their different Cloud native software.
So I remember authorization is that problems
of which people and which machines can perform
which actions on software.
And so the way this all got started was we were at DIEMware,
before we founded Styra,
and we were talking to a number of our customers
from finance and tech,
and what they did was they had built one of these things.
They had built a unified solution policy to manage
their authorization needs
across many different pieces of software.
So at that point we knew that the problem was very real,
cause people had to solve it themselves.
And so when-
>> I'm sorry Tim.
Just one thing to make sure I understand this.
So in the policy management
you talk about there, help me understand
how that fits into say
identity management which is one of the top things
we think about when I'm managing my IT,
when I go to the Cloud.
It seems related but different, yes?
>> Absolutely, yeah.
So identity management is really this problem
of who are you?
It's often solved, from a user's point of view,
by providing a username and a password, or a thumbprint,
or a multi-factor authentication.
That's an important problem that needs to be solved.
That's authentication or identity.
And it's really about proving who you are.
But authorization is the next step,
it's about what actions can you perform
once you've convinced the machine who you are.
And so really that's the piece that we focus on.
>> All right, yeah, once can we get people in we need...
It's usually you want to give them the least
amount of access possible.
We understand that from a security standpoint,
we need to do this.
So you've said what the kind of problem was,
and that this is there so how open source?...
I mean we know often it's, there's many reasons
why projects end up open source.
So give us the journey here.
So it started, we've really got two pieces of software,
So one of which, as you say is completely open source,
it's become the open policy agent project,
we decided to open source it
and then eventually donate it to the CNC
because it's sort of mission in life is to make
authorization decisions make decisions about if an action
that a user or machine is trying to take a safe or not.
And, that project is really designed to be a decision maker
across all the different kinds of software
in the cloud native ecosystem.
And so naturally, there's a need for a lot of expertise
about a whole bunch of different areas,
about a whole bunch of different pieces of software
and the best way to sort of leverage all of the world's
knowledge about all those different pieces of software
is to put that project out into the open.
And so for us, it was just an easy,
very easy thing to do.
Every single line of OPA of code that goes into OPA
has been done.
>> Well, absolutely it's a project I know
I've seen the stickers, I've seen people talking
about it in the breakout at KubeCon CloudNativeCon shows.
Let's not leave everybody, waiting for the news though Tim,
it had been an incubating project,
believe you've got some news for us.
Yeah, absolutely so OPA has now officially graduated,
it's now moved from incubation
into the graduation portion the CNCF.
And for us, it's really exciting because it really
is a reflection of the maturity of the project. Right?
There's so many people using OPA and using it to solve
all kinds of different use cases.
We're even seeing vendors pick it up
and offer native integrations
with their homegrown software.
So it's really exciting to see
the progress of the project has made
>> It just for audience that might not be familiar.
What does this mean now that it's graduated
as a maturity level?
Is it production?
Ready?
What what are those criteria that allowed
to go from that incubating stage to the graduation?
Yeah, so there are a bunch of criteria,
but I think the biggest one really
is really users in production, right?
It has been proven at scale for many different users
all over the world, right?
CNCF just did a survey recently there,
a couple hundred different organizations all across
the world who were using open in some way, shape or form.
We see it all the time and KubeCon
and CloudNativeCon talks, you can hear all about
all the folks who were using it.
>> Yeah, so maybe it would help if you've got a customer
example or use case that you can walk us through
as to how exactly that fits.
>> For sure yeah.
So the nice thing about OPA and more generally Styra
is that you can apply it to all different
kinds of use cases.
So there are a couple of very popular ones
using it for Kubernetes admission control
or micro service authorization,
those are the two most popular right now.
And they both work roughly the same way
but I'll give you a concrete example.
For Kubernetes, anytime some end users trying to spin up
any resource, whether the pod or an Ingress or anything
on the Kube cluster, you can integrate OPA
with that Kube API server and allow open make a decision,
is this new resource safe to deploy on the cluster?
Or is it not?
Micro service authorization works almost
exactly the same way, every time one of those micro services
receives an API call, it can ask OPA
is this API call safe for me to off to execute or not?
And so both of those are going to work
in basically the same way and that's true
for all the other applications and use cases for OPA.
>> Okay, and give us some of the stats if you would,
how many people how many companies
and people contribute to it?
What was the customer base look like?
>> So think they're a bunch of interesting metrics
I think that was the one that's most interesting
to me is that number of downloads a week.
Right now, we're at roughly a million downloads a week,
which is super exciting.
I remember those days when we hit
that one million mark total and we were very excited.
And so now we're at a point where it's every week,
we're hitting a million downloads,
all kinds of contributors as well and I think,
another good metric there to think about are, talks
I think we had nearly 50 talks,
organic talks from end users on OPA
that we ran across it last year.
>> Well it's wonderful is the thing we love
in that ecosystem there is it's not
just using it contributing,
to the code, sharing with the community.
Tim, what are the challenges in this ecosystem?
if you go to the CNCF website and you look at the landscape,
it's a little bit scary and taunting just
because there's so many different pieces.
What I understand from OPA is, are there any dependencies
there when you think about,
the other services that it interacts with?
Or does it just, kind of do its own thing enables customers?
>> Yeah, so OPA is,
was designed to be a standalone project, right?
It doesn't depend on really any other CNCF
or really any other project.
It was designed to make these policies
of these authorization decisions and but at the same time,
it's also designed to make it very easy to integrate
with a wide range of software systems.
And so, I think on the OPA website we've got over
25 different integrations that we are the community
have built around OPA, to go ahead and give you
and deliver on that vision of unified authorization.
>> You mentioned that styro has kind of two pieces
help us understand, what is graduating mean
for customers in general?
And for Styra?
Help us understand a little bit more of the business
that goes along with it.
>> So like I said, that first piece that we build
that first piece of software we built
was the policy agent project open source,
the second piece of software that we built
is a control plane for OPA.
The idea architecturally behind OPA
is that you don't have one copy of OPA running,
typically, you might have 10, or 100,
or thousand copies of OPA running.
And you do that for availability
and performance aid for decision making.
And so Styra second piece of software
is what we call the declarative authorization service.
It is a control plane and management plane,
a single pane of glass that allows
you to operationalize OPA at scale for the enterprise.
So it really is designed to give you that ability
to control and manage distribute policy,
right policy log all the policy decisions
for all those Opus.
And so that's really where we're, that's the second piece
of software that we're putting a lot of effort energy into.
>> All right, now that the great graduation
is there, what does this mean?
Give us a little bit of the roadmap, you're the CTO,
we know, there's always, feedbacks and other updates coming.
So what should we be expecting to be seeing going forward?
>> So there a couple of things I mentioned here,
one of which is that with OPA we did a survey recently,
just trying to get a sense as to what the community needs
and how they're using OPA and so one of the things we found
was that the fastest growing use case for OPA,
it looks to be application authorization, right?
So if you're building a custom application,
maybe it's a banking application, that application needs
to decide every time a user performs an action
is this authorized or not?
So if I'm trying to withdraw money from an account,
is it safe or not?
And so that's the fastest growing use case for OPA
that we saw on that and so what I expect to see
is more and more people talking about using OPA
for that application level authorization.
On the Styra side,
I think what we're looking forward to is just continuing
to chat with the community and understand what they need
around operationalizing OPA and making that control plane,
that management plane do all the things that enterprises
need to operationalize OPA at scale.
>> Tim, you've reached the graduation, which is a phenomenal
milestone in the project there, there's so many other
projects out there wonder what advice you would give
to other people starting business,
starting a project engaging with the open source community?
What have you learned along the way?
Any lessons learned?
And what feedback would you give others?
>> Absolutely, so if I'm talking to somebody else
who's interested in, starting an open source project,
I'll give them a little bit of advice.
So the first of which is that certainly
the code matters a lot,
it's codes got to be technically sound,
it's got to be solving real problems.
Everybody understands that. I think what a lot of people
understand less of is that when you start a project,
you need to put a lot of energy into growing,
that community that communication,
you need to focus a lot, you need to reach out to end users,
and actively engage with them.
Help them understand what the project's good for.
Help them be successful with it.
And so I think that piece is what a lot of people
don't really understand, and it's something that I think
we that if more people did,
we'd see a lot more successful open source projects.
>> Alright, Tim, I'll let you have the final word
and any final things you want to feed back
to the community or, potential customers for Styra?
>> Sure, so first of all, I'd like to say
thank you to all of our community members,
all the users who've worked with us, all the vendors
who are taking her doing integrations with OPA,
we'd love to see it, we'd love to see more of it.
And at the end of the day, I got to say I'm super excited
to be working both with OPA and our commercial
declared authorization service really deliver on that vision
of unified authorization
and deliver that to the vote to the world at large.
>> Tim, congratulations to you and the OPA team
and Styra definitely looking forward to seeing
you at the next gathering of the community.
And we'l hear more updates in the future.
>> Thanks so much for having me. Steve, this is great.
>> All right, and be sure to check out the cube.net
for all the back catalog of interviews that we've done,
including with the CEO Styra as well as upcoming events
that we will be at including,
of course KubeCon CloudNativeCon North America
happening later this year virtually.
I'm Stu Miniman, and thank you for watching theCUBE.