Deep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in Action
summary
Deep dive into Open Policy Agent, Conftest and Gatekeeper with concrete examples: shows rego policies applied as unit tests in CI via Conftest, policies pushed to an OCI registry, and Gatekeeper enforcing or mutating requests through the Kubernetes admission controller. Demonstrates real outages (memory leaks and missing limits that took clusters down; mis-placed YAML fields, wildcard Ingress) and claims Datree’s open-source CLI codifies 100+ postmortems into prebuilt policies that run locally, in CI, or live in-cluster with dry-run/audit support.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:10About the Tree
- 4:00Story of Unicorn Rentals
- 6:00Memory leak
- 10:30Default behavior
- 12:10Solution
- 16:00Open Policy Agent
- 20:10Conftest
- 22:00Docker Registry
- 24:00CI Integration
- 28:15Kubernetes Admission Controller
- 29:23Kubernetes Constraint Template
- 30:43Admission Controllers
- 31:57Postmortems
- 33:40Summary
related talks
28mDeep-dive into Open Policy Agent + Conftest + GateKeeper
37mDeep-dive into Open Policy Agent + Conftest + GateKeeper
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
34mUnit Testing Your Kubernetes Configurations Using Open Policy Agent
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
36mCentralized Policy Management
30mOpen Policy Agent Intro
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent