Applying Policy Throughout The Application Lifecycle with Open Policy Agent
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 29ABCD - San Diego Convention Center, Upper Level·
summary
Shows how Open Policy Agent (OPA) and Rego become executable policy: using Conftest to unit-test Kubernetes, Helm and pipfile configs; running those tests inside CI (example: Tecton) to fail or warn builds; deploying the same Rego as Gatekeeper constraint templates to block noncompliant deployments and audit clusters (ported Kubesec ruleset and Pod Security Policies); includes a Helm plugin, test assertions for Rego, and demo of violations reported then fixed.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:45What is policy
- 1:59Scaling policy enforcement
- 4:10What is Open Policy Agent
- 5:28Example of using Open Policy Agent
- 7:28Where is Open Policy Agent used
- 16:29Config
- 17:02Rules
- 17:59Pod Security
- 19:21CI Policy
- 22:28Gatekeeper
- 24:31Demo
- 28:07Summary
- 30:04Audience Questions
- 31:38Integration with AWS
- 33:36Package Management
- 35:15Why Rego
- 36:24Best Practices
- 37:38Github
related talks
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)
36mOpen Policy Agent: security for cloud natives and everyone else
39mOPA
30mOpen Policy Agent Intro
17mOpen Policy Agent Intro