OPA Policy Templating and Testing - Tejas Cherukara, ANZ Bank & Ben Ebsworth, Digio

on YouTube ↗25m

" summary

Shows how OPA policy becomes a production artifact: Rego is generated from templated Jinja policies with a shared library for common functions, unit tests are auto-generated and deliver 100% unit test coverage, and a small CLI (ankorCtl) plus CI pipelines run integration tests using kind-in-k8s to validate admission responses and mutations against a real cluster. Demo proves the pipeline runs end-to-end and catches policy regressions before merge.

AI-written summary · about

" chapters (12)

1. 0:00Start
2. 0:10OPA POLICY TEMPLATING AND TESTING
3. 0:23What is OPA?
4. 1:34USE CASE - DEV GUARDRAILS
5. 2:23USE CASE - SECURITY
6. 3:01USE CASE - ADMINISTRATIVE
7. 3:59SIMPLIFIED EXTENSION & MAINTENANCE
8. 5:36ADMISSION CONTROLLER
9. 7:05PROVIDE AN ABSTRACTION CONSISTENT WITH EXISTING ECOSYSTEM (YAML)
10. 8:34UNIT TESTING POLICY WITH 100% COVERAGE
11. 9:37INTEGRATION TESTING
12. 10:46ANCHORCTL

" related talks

• 33mOpen Policy Agent Deep DiveAnders Eknert · KubeCon + CloudNativeCon + Open Source Summit China 2021
• 40mOPA Introduction & Community UpdateRita Zhang, Patrick East · KubeCon + CloudNativeCon North America 2019
• 41mOpen Policy Agent (OPA) Intro & Deep DiveAnders Eknert, Will Beason · KubeCon + CloudNativeCon Europe 2022
• 39mApplying Policy Throughout The Application Lifecycle with Open Policy AgentGareth Rushgrove · KubeCon + CloudNativeCon North America 2019
• 45mOPA Deep DiveTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon North America 2019
• 32mOPA: So What Does the Policy Do?Jérôme Gauthier · Devoxx France 2023
• 39mOPAPeter O'Neill · KubeCon + CloudNativeCon North America 2022
• 31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy AgentPeter O'Neill · KubeDay Israel 2023