Secure Policy Distribution With OPA

on YouTube ↗22m

" summary

OPA pulls gzipped bundles of policies and data and now verifies a signatures.json file containing JWTs that list filenames and SHA hashes, using RS256 (or HS256) to check signatures. Command-line tools opa sign / opa build / opa run produce and verify signed bundles with a private/public key pair supplied out of band. Demo: a healthcare app hides claim fields when a verified bundle activates; when an attacker uploads a corrupt bundle OPA rejects it, logs verification errors, and continues using the last valid signed bundle.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 1:11OPA: General-purpose policy engine
3. 2:47OPA: Features
4. 5:51Bundles
5. 6:50The "Bundle" Problem
6. 7:41Introducing.... The Signed Bundle
7. 9:05"Signed" Bundle Verification
8. 10:48Command Line Tools
9. 12:53Demo Setup

" related talks

• 05mLightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) PoliciesOmri Gazitt · CloudNativeSecurityCon North America 2023
• 10mStrengthening Supply Chain Security By Enforcing Policies Using OPA G...Rita Zhang, Sertaç Özercan · Cloud Native Security Conference North America 2021
• 33mOpen Policy Agent Deep DiveAnders Eknert · KubeCon + CloudNativeCon + Open Source Summit China 2021
• 40mOPA Introduction & Community UpdateRita Zhang, Patrick East · KubeCon + CloudNativeCon North America 2019
• 41mOpen Policy Agent (OPA) Intro & Deep DiveAnders Eknert, Will Beason · KubeCon + CloudNativeCon Europe 2022
• 45mOpen Policy Agent Deep DiveTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon Europe 2018
• 45mOPA Deep DiveTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon North America 2019
• 25mMake Your Security Policy AuditableNicolas Fränkel · LambdaConf 2024