Open Policy Agent as a Control Engine

on YouTube ↗25m

" summary

Pipeline demo wires Open Policy Agent and Rego policies into GitHub Actions, running Bandit (SAST), gitLeaks (secrets), OWASP dependency‑check (SCA) and OWASP ZAP (DAST) against a small Python service deployed to localstack. Policies live in a central repo and ConfTest evaluates artifacts; policy eval blocks the PR when Bandit returns four high‑severity findings (and at least one medium). Code examples and act-based local runs prove the system works end‑to‑end.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 2:09What is OPA and use cases
3. 7:29Demo setup with Python microservice
4. 9:12Security tools in CI/CD
5. 12:21Writing policies in Rego
6. 14:54Live policy evaluation in CI
7. 21:47Testing policies in GitHub Actions
8. 23:14Centralized policy management
9. 24:17Closing remarks

" related talks

• 30mOpen Policy Agent IntroMax Smythe, Patrick East · KubeCon + CloudNativeCon North America 2020 Virtual
• 36mOpen Policy Agent: security for cloud natives and everyone elsePhilipp Krenn · DevOps Barcelona Conference 2023
• 17mOpen Policy Agent IntroAsh Narkar, Oren Shomron · KubeCon + CloudNativeCon Europe 2021
• 38mDeep Dive: Open Policy AgentTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon Europe 2019
• 38mPolicy as Code with Open Policy AgentAnders Eknert · CloudOpen @ Open Source Summit Europe 2022
• 33mIntro: Open Policy AgentTorin Sandall · KubeCon + CloudNativeCon China 2018
• 29mIntroduction to Open Policy AgentRita Zhang, Ash Narkar · KubeCon + CloudNativeCon North America 2021
• 39mApplying Policy Throughout The Application Lifecycle with Open Policy AgentGareth Rushgrove · KubeCon + CloudNativeCon North America 2019