OPA for the cloud natives

Stop embedding security rules in brittle scripts. OPA lets you manage policy as auditable, version-controlled code, enforced consistently across your stack.

#1about 3 minutes

Decoupling security checks from application deployment

Traditional embedded security checks are hard to audit and maintain, so decoupling them as policy-as-code enables continuous validation and simplifies compliance.

#2about 3 minutes

Shifting security left to prevent incidents before deployment

Proactively catching security violations in the CI pipeline is far better than reacting to incidents in production, moving beyond tribal knowledge to codified policies.

#3about 3 minutes

Introducing the Open Policy Agent (OPA) and Rego

OPA is a CNCF graduated project that provides a unified way to enforce policies across APIs using a custom declarative language called Rego.

#4about 3 minutes

Writing basic Rego policies for common use cases

Simple Rego policies can enforce rules like user data access control, manager hierarchies, or ensuring Kubernetes pods use a trusted container registry.

#5about 5 minutes

Using the OPA Playground to test and debug policies

The OPA Playground provides an interactive environment for writing, testing, and debugging Rego policies against sample input data, such as Kubernetes configurations.

#6about 2 minutes

Exploring OPA deployment patterns and advanced use cases

OPA can be deployed as a Go library or a sidecar daemon, enabling advanced use cases like validating Elasticsearch queries to enforce fine-grained data access control.

#7about 3 minutes

Automating infrastructure compliance with CIS benchmarks

OPA policies can codify Center for Internet Security (CIS) benchmarks to continuously scan Kubernetes clusters for misconfigurations and security vulnerabilities.

#8about 3 minutes

Addressing performance and adoption challenges with OPA

While powerful, OPA adoption can be hindered by the complexity of writing performant queries and the learning curve associated with its custom language, Rego.

#9about 3 minutes