Fine-grained Authorization in a Containerized World

on YouTube ↗34m

" summary

A lightweight policy engine called Open Policy Agent (OPA) evaluates JSON queries using the declarative Rego language and keeps policies and data in memory or fetched as tarball bundles. OPA deploys as an admission controller in Kubernetes, loads a policy that forbids identical ingress hostnames across namespaces, and in the live demo blocks Alice’s conflicting ingress so production traffic no longer routes to dev. Integrations and decision logs enable testing and auditing.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 1:06What is Kubernetes
3. 2:41Intentbased API
4. 7:40What is Opa
5. 9:37Why Opa
6. 13:04Opa Integrations
7. 14:46How does OPA work
8. 21:54Use cases
9. 23:49Admission Control
10. 25:52Demo
11. 33:19Outro

" related talks

• 19mDynamic Authorization and Policy Control for Your Kubernetes ClusterAsh Narkar · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 17mOpen Policy Agent IntroAsh Narkar, Oren Shomron · KubeCon + CloudNativeCon Europe 2021
• 45mOPA Deep DiveTim Hinrichs, Torin Sandall · KubeCon + CloudNativeCon North America 2019
• 29mIntroduction to Open Policy AgentRita Zhang, Ash Narkar · KubeCon + CloudNativeCon North America 2021
• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith NambiarMark Puddick, Amith Nambiar · Kubernetes Forum Sydney 2019
• 29mOpen Policy Agent (OPA) Intro & Deep DiveAnders Eknert, Charlie Egan · KubeCon + CloudNativeCon Europe 2025
• 33mOpen Policy Agent Deep DiveAnders Eknert · KubeCon + CloudNativeCon + Open Source Summit China 2021
• 39mOPAPeter O'Neill · KubeCon + CloudNativeCon North America 2022