Policing Your Kubernetes Clusters with Open Policy Agent (OPA)
summary
Shows a live Rego policy that only allows container images beginning with myregistry.io, deployed as a ConfigMap and picked up by kubemuilder/kubemgmt caching so OPA evaluates locally via the admission webhook. Demonstrates unit testing with opa test, then applies a Pod that references badregistry.io and OPA returns a denial with the message image not from trusted registry. Mentions Gatekeeper v3 templating for reusable policies.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:55What is OPA
- 4:23Examples
- 5:21Admission Controllers
- 7:08OPA v1
- 8:52OPA v3
- 9:55Installation
- 10:45Overview
- 12:04Policy Implementation
- 12:27Request Evaluation
- 14:30Playground
- 16:30Unit Testing
- 20:00Deployment Testing
- 21:40Summary
- 23:19Getting Context in Policies
related talks
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
34mFine-grained Authorization in a Containerized World
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
39mOPA
29mIntroduction to Open Policy Agent
17mOpen Policy Agent Intro