Lightning Talk: CRDs All the Way Down – Using OPA for Complex CRD Validation and Defaulting

on YouTube ↗05m

" summary

Shows how Open Policy Agent (OPA) and Gatekeeper replace hand‑written admission controllers by using mutating and validating webhooks to implement real CRD defaults and checks. Demonstrates an app-install CRD that defaults catalog and version (defaults latest stable), validates catalog existence and app/version against live data, and uses namespace/context to set config. Explains why Rego policies are easier to maintain than separate Go admission controllers and how to bundle rules with CRDs and controllers.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 0:05Validating and Defaulting Complex Custom Resources with Open Policy Agent
3. 0:46Open Api V3 Schemas
4. 1:00Invalidation

" related talks

• 27mEmbracing change: Policy-as-code with OPA and GatekeeperAra Pulido · Conf42 Cloud Native 2021
• 05mLightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) PoliciesOmri Gazitt · CloudNativeSecurityCon North America 2023
• 31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy AgentPeter O'Neill · KubeDay Israel 2023
• 40mIntro: Open Policy AgentRita Zhang, Max Smythe · KubeCon + CloudNativeCon Europe 2019
• 39mOPAPeter O'Neill · KubeCon + CloudNativeCon North America 2022
• 29mIntroduction to Open Policy AgentRita Zhang, Ash Narkar · KubeCon + CloudNativeCon North America 2021
• 17mOpen Policy Agent IntroAsh Narkar, Oren Shomron · KubeCon + CloudNativeCon Europe 2021
• 25mDesign Patterns for Extendable, Scalable K8s ExtensionsRita Zhang, Max Smythe · KubeCon + CloudNativeCon North America 2020 Virtual