Enforcing Service Mesh Structure using OPA Gatekeeper
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 16:25· Room 6F - San Diego Convention Center, Upper Level·
summary
Describes deploying OPA Gatekeeper as a Kubernetes admission controller that embeds Rego rules inside a constraint template and applies per-namespace constraint objects to either deny admission or run dry‑run audits. Shows concrete checks for Istio-style issues: bad service port naming, mismatched or disabled mTLS via destination rules, and colliding virtual service URIs. Demos run live against a cluster, demonstrate Gatekeeper blocking or reporting violations, and recommend using the Rego playground and GitHub repo for examples.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:41Open Policy Agent
- 7:30Policy Objects
- 11:03Gatekeeper Config
- 12:13Why Service Mesh?
- 22:13Demos
- 33:19Policy Controller
- 34:25Questions?
related talks
32mSecuring our clusters with gatekeeper and OPA
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
14mPolicy-as-code for Kubernetes with Gatekeeper
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)