Policing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar

on YouTube ↗25m

" summary

Open Policy Agent runs as an external policy engine hooked into the Kubernetes admission webhook and evaluates Rego policies stored as ConfigMaps; the demo shows a Rego rule that blocks images not from myregistry.io, a rule that rejects pods in production without CPU limits, and unit tests run locally via the Rego playground. Policies deploy as ConfigMaps, OPA annotates status policy status: ok, and Gatekeeper v3 adds templated CRDs for reuse.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:38What is OPA
3. 6:50Architectures
4. 10:47Policy Language
5. 13:40Record Playground
6. 15:22Resource Limits
7. 16:35Unit Testing
8. 19:09Config Map
9. 20:06Check Policy Syntax
10. 21:05Check Policy Evaluation
11. 22:17Summary

" related talks

• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)Mark Puddick, Amith Nambiar · Kubernetes Forum Seoul 2019
• 39mApplying Policy Throughout The Application Lifecycle with Open Policy AgentGareth Rushgrove · KubeCon + CloudNativeCon North America 2019
• 19mDynamic Authorization and Policy Control for Your Kubernetes ClusterAsh Narkar · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 30mSecuring the Kubernetes Empire with OpenPolicyAgent and RegoNavin Pai · KubeDay India 2023
• 34mFine-grained Authorization in a Containerized WorldAsh Narkar · Open Source Summit + Embedded Linux Conference North America 2019
• 39mOPAPeter O'Neill · KubeCon + CloudNativeCon North America 2022
• 17mOpen Policy Agent IntroAsh Narkar, Oren Shomron · KubeCon + CloudNativeCon Europe 2021
• 29mIntroduction to Open Policy AgentRita Zhang, Ash Narkar · KubeCon + CloudNativeCon North America 2021