The Battle of Policies: OPA’s Rego vs. JSON Schema
summary
Compares OPA Rego and JSON Schema by validating real Kubernetes manifests (schema versions, labels, image tags, probes, CPU/memory limits) inside CI/CD and as admission controllers; the team interviews 1,000+ customers and reports Datree (5,000+ GitHub stars) implements custom policies via policies.yaml (written as YAML, converted to JSON) and runs them in its engine. Rego gives richer conditional logic but is harder to master, while JSON Schema is broadly supported and easier for teams to adopt. Rego offers richer policy logic JSON Schema wins for simplicity and ecosystem support
AI-written summary · about
chapters (7)
- 0:00Introduction to policy
- 1:22Need for policy enforcement
- 2:22Understanding Rego
- 6:41Deep dive into Rego usage
- 12:21Understanding JSON schema
- 17:21Comparing Rego and JSON schema
- 21:35Choosing the right solution
related talks
39mOPA
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
34mFine-grained Authorization in a Containerized World
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
29mOpen Policy Agent (OPA) Intro & Deep Dive
32mOPA: So What Does the Policy Do?
45mOPA Deep Dive