Unit Testing Your Kubernetes Configurations Using Open Policy Agent

on YouTube ↗34m

" summary

Unit tests run Open Policy Agent policies against rendered Kubernetes manifests and other structured outputs, catching issues before cluster deploy. The workflow uses regol (uploader spelling) policies and OPA’s test harness, a local CLI called contest to check manifests from kubectl/Helm/Kustomize/Pulumi or Terraform (terraform show → JSON), and gates as deny or warn. Examples include denying containers without runAsNonRoot and requiring specific labels; bundles publish policies to OCI registries via bundle bar for reuse.

AI-written summary · about

" chapters (9)

1. 0:00Introduction to the talk
2. 2:05What is Open Policy Agent
3. 4:25Shifting left with testing
4. 7:35Introduction to Conftest
5. 13:31Working with the Rego language
6. 17:06Sharing policies and bundles
7. 22:46Testing infrastructure configurations
8. 26:08Terraform and beyond
9. 32:01Conclusion and future outlook

" related talks

• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith NambiarMark Puddick, Amith Nambiar · Kubernetes Forum Sydney 2019
• 37mDeep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in ActionNoaa Barki, Shimon Tolts · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 28mDeep-dive into Open Policy Agent + Conftest + GateKeeperNoaa Barki, Shimon Tolts · Yalla DevOps 2021
• 19mDynamic Authorization and Policy Control for Your Kubernetes ClusterAsh Narkar · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 38mOPA for the cloud nativesPhilipp Krenn · DevOpsDays Warsaw 2022
• 30mOpen Policy Agent IntroMax Smythe, Patrick East · KubeCon + CloudNativeCon North America 2020 Virtual
• 41mYou Shall Not Pass! Policy Compliance with OPA GatekeeperNiccolò Raspa · KCD Italy 2021
• 36mOPA for the cloud nativesPhilipp Krenn · Voxxed Days Ticino 2023