OPA for the cloud natives
summary
OPA enforces decoupled, continuously running policies that aim to catch misconfigurations faster than attackers, using Rego policies and JSON data loaded in memory. It evaluates Kubernetes objects, SSH settings, Terraform plans and CI/CD inputs, can gate applies (example: Terraform plan gating used by DoorDash), and runs locally as a daemonset/sidecar deployment or standalone HTTP agent. Elastic integrates OPA into its agents; Netflix-style scale and thousands-of-service use cases are reported to work.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 2:06Why decouple policy from config
- 8:47OPA overview and use cases
- 11:55How OPA works technically
- 16:13Policy examples in Kubernetes
- 20:03OPA playground demo
- 24:05Running OPA as a service
- 31:27Vendor implementations and tools
- 34:59Why OPA outside applications
- 35:55Q&A session
