OPA Introduction & Community Update
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 10:55· Room 5AB - San Diego Convention Center, Upper Level·
summary
OPA is a Rego-based policy engine with 70+ contributors and ~1,200 Slack users that evaluates JSON inputs and now runs via HTTP, Go embedding or WebAssembly runtimes. Gatekeeper v3 turns policies into CRDs using constraint templates and constraint instances, adds dry‑run audit rollout, Prometheus metrics, and bundle support from S3/GCS/OCI. Demo shows it blocks bad image repos, enforces owner labels, detects duplicate ingress hosts, reports violating pods via audits, and lets admins validate rules before enforcing.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:31About OPA
- 2:10What is OPA
- 6:01Integrations
- 6:31Use Cases
- 7:45Updates
- 9:37New integrations
- 10:09Admission Controller
- 10:42Gatekeeper
- 13:30How did we get here
- 14:49Gatekeeper Architecture
- 17:53Difference between v1 v3
- 21:27New Features
- 22:55Demo
- 23:29Agile Bank Policies
- 24:32OPA Gatekeeper
- 29:56Resource Limits
- 35:47Prometheus
