Design Patterns for OPA and Cloud Native Authorization

on YouTube ↗42m

" summary

Open Policy Agent (OPA) and its Rego policy language provide concrete patterns: run OPA offline on developer laptops and CI to block bad configs (seconds–minutes acceptable), run OPA as an admission hook for live Kubernetes with ~10–100 ms latency, or deploy a sidecar per instance for API auth with ~1 ms targets and ~1k QPS. Policies use JSON inputs, external data like PagerDuty or LDAP for context, and operational choices include fail open vs fail closed and centralized vs replicated deployment.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 8:31What Is Oppa
3. 11:23Data and Json
4. 15:07Policy Language
5. 25:48Opus Policy Language
6. 29:13Online Version of Configuration Authorization
7. 35:41Policies

" related talks

• 38mOPA for the cloud nativesPhilipp Krenn · DevOpsDays Warsaw 2022
• 19mDynamic Authorization and Policy Control for Your Kubernetes ClusterAsh Narkar · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 36mOPA for the cloud nativesPhilipp Krenn · Voxxed Days Ticino 2023
• 34mFine-grained Authorization in a Containerized WorldAsh Narkar · Open Source Summit + Embedded Linux Conference North America 2019
• 33mOpen Policy Agent Deep DiveAnders Eknert · KubeCon + CloudNativeCon + Open Source Summit China 2021
• 45mOpen Policy Agent Deep DiveTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon Europe 2018
• 38mPolicy as Code with Open Policy AgentAnders Eknert · CloudOpen @ Open Source Summit Europe 2022
• 41mOpen Policy Agent (OPA) Intro & Deep DiveAnders Eknert, Will Beason · KubeCon + CloudNativeCon Europe 2022