Securing the Kubernetes Empire with OpenPolicyAgent and Rego

on YouTube ↗30m

" summary

Explains how OpenPolicyAgent + Rego run as a service or library and how OPA Gatekeeper enforces Kubernetes policies via internal registries only and CRD-based constraint templates, with examples for JWT decoding, a failing pod blocked for missing team label, running as root, or exceeding a 200m CPU limit. Shows Helm/kubectl install (two commands), audit vs deny modes, scaling replicas, and a prebuilt Gatekeeper library; recommends KISS, deny-by-default, and keeping all policies in Git for reproducible, auditable enforcement.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 1:46Agenda
3. 3:54Policy as code in Kubernetes
4. 10:13OPA and Rego basics
5. 14:23OPA in Kubernetes with Gatekeeper
6. 17:13Policy enforcement with constraints
7. 21:54Live demo: Gatekeeper policies
8. 24:21Gatekeeper library and community
9. 25:03Best practices for Rego policies
10. 28:35Future of policy management
11. 30:00Q&A

" related talks

• 39mApplying Policy Throughout The Application Lifecycle with Open Policy AgentGareth Rushgrove · KubeCon + CloudNativeCon North America 2019
• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith NambiarMark Puddick, Amith Nambiar · Kubernetes Forum Sydney 2019
• 32mSecuring our clusters with gatekeeper and OPAMichael Irwin · KCD Washington DC 2021
• 14mPolicy-as-code for Kubernetes with GatekeeperAra Pulido · KubeCon + CloudNativeCon Europe 2021
• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)Mark Puddick, Amith Nambiar · Kubernetes Forum Seoul 2019
• 30mOpen Policy Agent IntroMax Smythe, Patrick East · KubeCon + CloudNativeCon North America 2020 Virtual
• 35mEnforcing Service Mesh Structure using OPA GatekeeperSandeep Parikh · KubeCon + CloudNativeCon North America 2019
• 28mEmbracing change: Policy-as-code for Kubernetes with OPA and GatekeeperAra Pulido · stackconf online 2021