Security-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
summary
Claims that authorization can be enforced pervasively by running Open Policy Agent next to services, using network proxies for transparent enforcement and Kubernetes admission hooks via Gatekeeper. Shows concrete tooling: the rego language, Playground, VS Code plugins, Conftest for CI, unit tests and debug traces. Demonstrates a deny rule that rejects pod images not from huli.com (evaluation returns true) and describes injecting external JSON (PagerDuty on‑call data) so policies stay context‑aware and evolvable.
AI-written summary · about
chapters (10)
- 0:00Introduction to OPA
- 0:25Security in the cloud era
- 2:22Core authorization requirements
- 5:06Unified policy via OPA
- 7:17The OPA ecosystem
- 9:17How OPA engine works
- 12:36Advanced policy features
- 15:29Common OPA use cases
- 18:54Policy lifecycle tooling
- 22:03Practical policy writing
related talks
25mMake Your Security Policy Auditable
30mOpen Policy Agent Intro
32mImplementing Authorization
34mFine-grained Authorization in a Containerized World
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
37mMake your security policy auditable
25mThe right feature at the right place: the example of authorization