Kubernetes Policy Enforcement Using OPA At Goldman Sachs
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 17:20· Room 16AB - San Diego Convention Center, Mezzanine Level·
summary
Goldman Sachs runs OPA on 12 shared Kubernetes clusters (avg 159 namespaces/cluster) for both validating admission control (e.g., preventing conflicting ingresses) and a novel provisioning via OPA bundles flow where OPA returns JSON Kubernetes resources (RBAC, Quotas, PVs) that a trimmed controller-manager (trimmed) applies with kubectl. Policy/data live in configMaps and bundles; deployment time drops from days to under 10 minutes, median decision latency <30 ms, eventual consistency ~2–5 minutes.
AI-written summary · about
chapters (18)
- 0:00Intro
- 5:50Explanation
- 8:10OPA Features
- 13:49Uplevel OPA
- 14:40Previous approach
- 16:44What we wanted
- 17:40How OPA works
- 19:26Baseline rule
- 20:06Special team X
- 21:17Queue Management
- 23:23Proprietary Data
- 25:09Query and Provision
- 27:46Metrics
- 28:09Evaluation
- 29:42Lessons Learned
- 30:45Future Work
- 31:24Questions
- 32:54Inventory Management Workflow
related talks
38mOPA for the cloud natives
26mBeyond Security: Leveraging OPA for FinOps in Kubernetes - Sathish Kumar Venkatesan
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
34mFine-grained Authorization in a Containerized World
33mOpen Policy Agent Deep Dive
32mSecuring our clusters with gatekeeper and OPA
42mDesign Patterns for OPA and Cloud Native Authorization
41mOpen Policy Agent (OPA) Intro & Deep Dive