Embracing change: Policy-as-code with OPA and Gatekeeper
summary
Gatekeeper embeds OPA to enforce concrete policy decisions at admission time and uses Kubernetes CRDs so policies become real objects. The demo shows reusable constraint templates instantiated as constraints that block pod creation until a required label exists and an audit pass that surfaces existing violations (about 14 pods flagged). A sync CRD seeds cluster data so rules can enforce global properties like unique ingress hosts. Metrics ship to Datadog out of the box and the components run and enforce as demonstrated.
AI-written summary · about
chapters (15)
- 0:00Policy as code intro
- 1:02Kubernetes and policy needs
- 2:45RBAC enforcement limits
- 3:49OPA for unified decisions
- 5:16Gatekeeper in Kubernetes
- 7:19Constraint templates
- 9:26Gatekeeper library
- 11:32Gatekeeper metrics
- 12:13Deploying Gatekeeper
- 14:24Enforcing pod labels
- 18:47Auditing violations
- 21:19Blocking invalid deployments
- 22:24Validating ingress hostnames
- 23:49External data for policies
- 26:38Summary
related talks
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
14mPolicy-as-code for Kubernetes with Gatekeeper
40mIntro: Open Policy Agent
34mGatekeeper: Flexible, Shareable Policy for Kubernetes
32mSecuring our clusters with gatekeeper and OPA
10mThe Power of OPA Gatekeeper: Enforcing Kubernetes Access Control to secure your runtime
40mOPA Introduction & Community Update