Deploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent
summary
Explains Policy-as-Code with Open Policy Agent as a decoupled decision engine, shows architecture patterns (sidecar, admission controller/Gatekeeper, Terraform and Envoy integrations) and a Rego RBAC example that checks Alice vs Bob on object types, includes Rego unit tests and a policy benchmarking tool that measures runtimes down to nanoseconds and surfaces costly nested iterations, cites OPA as a small Go binary used at scale (example: thousands of authorization decisions per second at Miro), and recommends starting with one small policy and iterating.
AI-written summary · about
chapters (21)
- 0:00Welcome
- 0:42Introduction
- 1:25Why policy-as-code emerged
- 3:14AuthN vs AuthZ
- 6:26Policy-as-code benefits
- 7:27Policy management evolution
- 9:55Policy lifecycle and CI/CD
- 10:56Open Policy Agent
- 11:38OPA decoupling enforcement
- 14:07OPA use cases
- 15:54Kubernetes with Gatekeeper
- 16:15Terraform policy enforcement
- 16:35Service auth with Envoy
- 17:59OPA architecture
- 18:22Rego introduction
- 19:50Simple RBAC policy
- 21:33Rego basics
- 23:20Granular Rego checks
- 25:07Unit testing policies
- 26:30Readable Rego policies
- 29:03Q&A
related talks
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
29mOpen Policy Agent (OPA) Intro & Deep Dive
36mOpen Policy Agent: security for cloud natives and everyone else
32mImplementing Authorization
38mPolicy as Code with Open Policy Agent
32mOPA: So What Does the Policy Do?
14mA Policy-as-Code Approach to RBAC Authorization
39mIntro: Open Policy Agent