Slowing Our Role: Moving Towards Policy at Plex
Talkat Cloud Native Security Day 2019 · on Monday, 2019-11-18· at 10:55· Marriott Marquis San Diego Marina - San Diego Ballroom A, 333 W Harbor Dr·
summary
Plex moves from hundreds of brittle roles to codified checks that allow resource creation and repo changes without human signoff, cutting multi-day waits (one simple domain request once took two weeks). Implementation uses conftest + OPA + Gatekeeper for local/CI validation and in-cluster enforcement, Terraform modules for provisioning, an Azure Function to apply repo policy changes, and repo-level policies for ongoing config drift detection. The claim: policy encodes maintainers’ intent so automation enforces constraints while owners retain override access for emergencies.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:24Roles
- 2:31Module Champion
- 5:27Story Time
- 7:11The Right Choices
- 7:52The Right Mindset
- 8:03Automatic Approvals
- 9:07Open Policy Agent
- 9:34Policy Example
- 10:33CompTest
- 11:14Pipeline
- 12:14Terraform
- 14:28Configuration
- 14:39Repository Policies
- 15:53Gatekeeper
- 19:00Going Forward
- 20:28Questions
related talks
25mPolicy as [versioned] Code
43mEmpowering The Guardians Of Your Code Kingdom
22mPolicy as [versioned] Code - How to do it Right
38mEnabling Autonomous Teams With Policy Enforcement at Yubico
36mCentralized Policy Management
30mRedefining Access Control: Scaling Policy as Code for Humans and AI Agents
12mEnd-to-end policy-as-code from IaC to Running Workloads
20mDeep Dive: Kubernetes Policy WG