Intro: Open Policy Agent
summary
Open Policy Agent Gatekeeper integrates OPA with Kubernetes as an admission webhook that enforces declarative, CRD-packaged policies called constraint templates plus per-instance constraints that carry parameters; it supports data replication for cross-resource checks, a periodic audit feature that lists violations in constraint status, and rejects invalid admits with user-facing messages. Project is alpha (beta targeted end of June 2019), works for enforcing label, image repo, resource-limit and global-service-uniqueness policies, and plans mutation, dry-run, and Prometheus metrics.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:50History of Kubernetes Policy Controller
- 3:20Gatekeeper
- 9:12Constraint Resource
- 11:26Audit
- 13:02Constraint Template
- 15:45Mission System
- 22:48Project Status
- 23:29Whats Next
- 25:45Thank You
- 27:13Scale Problems
- 28:30Prioritize Rules
- 29:36Rollback
- 30:39CI Pipeline
- 31:42Multitenancy
- 33:11Constraint Templates
- 34:48Matching Semantics
- 37:05Reference Model
- 37:43Selector Logic
related talks
29mIntroduction to Open Policy Agent
17mOpen Policy Agent Intro
30mOpen Policy Agent Intro
41mOpen Policy Agent (OPA) Intro & Deep Dive
38mPolicy as Code with Open Policy Agent
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
33mOpen Policy Agent Deep Dive
40mOPA Introduction & Community Update