Beyond Security: Leveraging OPA for FinOps in Kubernetes - Sathish Kumar Venkatesan
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 14:15· Level 1 | Hall Entrance S10 | Room A·
summary
Shows how Open Policy Agent plus Gatekeeper enforce FinOps guardrails in Kubernetes by denying expensive choices and mutating requests and by auditing existing workloads. Demonstrations include a policy that blocks premium SSDs in dev, a constraint requiring CPU requests, and an integration with OpenCost that calculates projected spend and stops a 3‑core deployment that would push a namespace from $5,000 to $7,000. Cites survey numbers: about 10% CPU utilization and ~23% memory used, so policies run successfully in the demo.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:04FinOps challenges in Kubernetes
- 3:35OPA fundamentals
- 5:20Why OPA for FinOps
- 8:12Practical OPA policies
- 11:38Getting started with OPA
- 15:28Live demo of OPA policies
- 24:36Q&A
related talks
28mDeep-dive into Open Policy Agent + Conftest + GateKeeper
37mKubernetes Policy Enforcement Using OPA At Goldman Sachs
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
41mYou Shall Not Pass! Policy Compliance with OPA Gatekeeper
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
29mIntroduction to Open Policy Agent
40mIntro: Open Policy Agent
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper