Introduction to Open Policy Agent
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 15:25· Concourse Hall 150 ABC + Online·
summary
Open Policy Agent (OPA) is a graduated CNCF policy engine with ~150 contributors, ~4,500 Slack members and ~5,000 GitHub stars that uses the declarative language Rego, runs as sidecar/daemon/embedded or compiled to wasm, and evaluates policies in-memory while offering management APIs. Roadmap items include on-disk loading to reduce memory, delta bundles to send diffs instead of full gzip tarballs, and wasm performance work. Gatekeeper exposes a Kubernetes constraint framework and pre‑alpha external data providers that mutate tags to digests, verify signatures with cosign, scan with Trivy, and add AAD owner labels — demos show blocking unsigned or vulnerable images and successful mutations.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:36Overview
- 1:57Policy Enforcement Problem
- 9:31Integrations
- 9:58Roadmap
- 13:50conftest
- 16:00gatekeeper
- 22:54demo
