Using Open Policy Agent to Meet Evolving Policy Requirements
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 17:05· Intrado Virtual Event Platform,·
summary
Managed Kubernetes for 30+ teams meets FedRAMP High and PCI by running OPA + kube-mgmt sidecar as validating and mutating admission webhooks written in Rego. Policies deny and patch (mutate) rules enforce a single gov registry (blocks non-approved images and rewrites upstream refs via JSONPatch), auto-apply tags from a configmap inventory, and add non‑root securityContext when missing. Vulnerability scanning (Twistlock, trivy suggested) drives twice‑daily image rebuilds to fix CVSS ≥4 findings required by PCI/FedRAMP controls (~400 controls for FedRAMP High).
AI-written summary · about
chapters (20)
- 0:00Start
- 0:48VMware Developer Platform
- 3:06Challenges!
- 3:28Webhooks!
- 4:56Our scope grows...
- 5:49More Grow Pains....
- 8:45Some policy wants...
- 10:18Enforcing Policy....
- 11:01It's Admission Control, I know this
- 12:01policy.rego
- 15:37Let's restrict registries!
- 25:27We made a process...
- 26:19We automated...sorta
- 27:12How's that work?
- 27:31More mutation!!
- 28:12Update pipeline
- 28:48Pod Security Policies!
- 29:13Hello again, Mutation.
- 29:48Recapping.
- 31:41Links!
related talks
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
29mIntroduction to Open Policy Agent
39mOPA
10mStrengthening Supply Chain Security By Enforcing Policies Using OPA G...
38mPolicy as Code with Open Policy Agent
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)