Open Policy Agent: security for cloud natives and everyone else

on YouTube ↗36m

" summary

Overview of using Open Policy Agent to codify runtime checks for APIs, Kubernetes and apps, with concrete integrations: policies written as Rego policies served from a local agent or embedded Go library, evaluated in pull requests for IaC via Terraform PR gating (Atlantis fetches policies from S3), and run continuously with Cloudbeat against CIS benchmarks (example run shows 86% compliance and 52 failing rules). Notes: Rego has a steep learning curve, some queries can be 3x optimized, and colocated agents avoid cross‑node latency.

AI-written summary · about

" chapters (12)

1. 0:00Introduction to security policies
2. 1:37Problems with traditional security checks
3. 7:17What is Open Policy Agent
4. 12:34OPA use cases in infrastructure
5. 14:21OPA in application security
6. 15:45OPA playground demo
7. 21:10OPA for Elasticsearch queries
8. 22:32CIS benchmarks with OPA
9. 27:57Debugging and optimizing Rego
10. 29:01Why externalize security policies
11. 30:24Challenges with Rego
12. 32:11Q&A session

" related talks

• 36mOPA for the cloud nativesPhilipp Krenn · Voxxed Days Ticino 2023
• 39mIntro: Open Policy AgentTorin Sandall · KubeCon + CloudNativeCon China 2019
• 30mOpen Policy Agent IntroMax Smythe, Patrick East · KubeCon + CloudNativeCon North America 2020 Virtual
• 33mIntro: Open Policy AgentTorin Sandall · KubeCon + CloudNativeCon China 2018
• 39mApplying Policy Throughout The Application Lifecycle with Open Policy AgentGareth Rushgrove · KubeCon + CloudNativeCon North America 2019
• 31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy AgentPeter O'Neill · KubeDay Israel 2023
• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith NambiarMark Puddick, Amith Nambiar · Kubernetes Forum Sydney 2019
• 39mIntro: Open Policy AgentTorin Sandall · KubeCon + CloudNativeCon + Open Source Summit China 2019