Applying Policy Throughout The Application Lifecycle with Open Policy Agent - Gareth Rushgrove, Snyk

Описание: Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Applying Policy Throughout The Application Lifecycle with Open Policy Agent - Gareth Rushgrove, Snyk

Open Policy Agent is built to be used as a library in other tools and there are already several open source projects using OPA as generic policy engine. This is powerful because it allows end users to invest in one use case, and reuse some of the same knowledge and tools, especially the Rego data assertion language, to solve other adjacent problems. In this talk we will look at applying Open Policy Agent tools throughout the application lifecycle. We’ll explore: * Writing unit tests for Kubernetes configuration (and Helm charts) using Conftest * Defining a CI pipeline in code, and testing that using OPA * Gating deployments to the cluster using Gatekeeper * Auditing the cluster for security best practices, by porting the Kubesec ruleset to Rego * Porting pod security policies to OPA * Writing unit tests for the Rego policy code we wrote above

https://sched.co/UaW8