Security and Flexibility: Decouple Policy to Enable Architectural Choice
summary
Open Policy Agent (OPA) claims to decouple policy decision from enforcement by evaluating JSON queries in memory and returning JSON decisions, running as sidecar, host daemon, Go lib or compiled to wasm. It uses the high level language Rego, logs every decision, and supports bundles for management. Production adopters include Netflix, Pinterest, Intuit and Capital One; the project is CNCF graduated with 150+ contributors, ~4,000 Slack members and ~5,500 GitHub stars. Common builds: Kubernetes admission controller and Envoy external auth, both working at scale.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:30Agenda
- 0:50Cloud Native Landscape
- 2:40What is Opa
- 4:10How Opa works
- 5:35Opa features
- 9:47Kubernetes
- 12:15API Authorization
- 14:42Convoy
- 16:43Outro
