Secure by Default with GitOps - A Guide to OPA with Argo CD
summary
Shows a concrete pipeline: CI builds images, runs a cosign signing workflow that pushes signatures to the registry, then Argo CD syncs the gitops repo and OPA Gatekeeper enforces policies so unsigned or floating-tag images are rejected. Demonstrates Argo CD 2.4 vs 2.5 behavior (2.5 adds server-side dry-run to catch webhook rejections earlier), uses sync waves/app-of-apps and Argo CD Autopilot to bootstrap policies before workloads, and includes the demo repo todaywasawesome/osssecure with example manifests.
AI-written summary · about
chapters (5)
- 0:00Start
- 6:44OPA is a general purpose policy engine
- 7:50OPA Gatekeeper
- 24:24Set sync waves for apps
- 25:40Demo: Prevent applying resources without Argo CD
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
18mDevOps All the Things: Creating a Pipeline to Validate Your OPA Policies
31mSelf Healing GitOps: Continuous, Secure GitOps Using Argo CD, Helm and OPA
34mTrust But Verify: Bringing Supply Chain Integrity To CD GitOps
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...
10mThe Power of OPA Gatekeeper: Enforcing Kubernetes Access Control to secure your runtime
09mSecuring GitOps
06mLightning Talk: Secure GitOps for Regulated Workloads: Argo CD Meets Confidential...