> Markdown version of [/videos/713-opa-for-the-cloud-natives?t=502](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives?t=502). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# OPA for the cloud natives

Are your security checks tightly coupled to your code? Open Policy Agent decouples them. Discover how shifting left with policy-as-code automates your cloud-native governance.

- **Speakers:** Philipp Krenn
- **Event:** World Congress 2023
- **Published:** September 27, 2023
- **Duration:** 26:23
- **URL:** https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives

## Summary

Traditional deployment setups often tightly couple security checks with infrastructure scripts, making continuous validation and compliance auditing difficult. The Open Policy Agent (OPA), a CNCF graduate project, solves this by decoupling security policies from application logic. By treating policies as code, organizations can continuously monitor their environments for drift, codifying security "tribal knowledge" into enforceable rules and shifting from a reactive "everything is on fire" posture to automated, proactive governance.

OPA operates against any API to evaluate input data against custom rules written in the Rego policy language. Practical implementations range from validating Kubernetes deployment labels and checking Terraform plans in CI pipelines (immediately blocking pull requests that violate infrastructure policies) to filtering database queries in systems like Elasticsearch. This shift-left approach ensures that attackers are thwarted and misconfigurations are caught before changes even reach production.

Despite its power and adoption by major enterprises, OPA faces hurdles due to the steep learning curve of Rego and the overall footprint of the tooling. Optimizing policy performance can require extensive profiling and low-level debugging. Ultimately, there are no "silver bullets" in cloud-native security; OPA is not a standalone remedy but a highly versatile component of a broader security methodology that replaces assumptions with continuous, unified validation.

**Keywords:** open policy agent, rego policy language, policy as code, continuous security validation, kubernetes compliance checks, shift-left security, terraform plan validation, CNCF graduate projects, infrastructure drift monitoring, CIS benchmarks, CI pipeline security, API security validation, elasticsearch query filtering, decoupled deployment pipelines, automated compliance auditing

## Chapters

1. **Decoupling security checks from deployment pipelines** (00:02) — How separating security policies from application code enables continuous auditing and compliance.
1. **Classifying security incidents and proactive prevention** (02:59) — Why catching policy violations in continuous integration is preferable to relying on tribal knowledge or vendor fixes.
1. **Core concepts and architecture of Open Policy Agent** (05:46) — How OPA evaluates queries against policies and data to return decisions across different APIs.
1. **Writing basic access and resource policies in Rego** (08:22) — Examples of using Rego to enforce user access limits, management hierarchies, and container registry origins.
1. **Enforcing policy validations in continuous integration pipelines** (11:38) — How companies use OPA to validate Terraform plans against policies before allowing pull request merges.
1. **Testing and debugging rules in the OPA playground** (13:00) — A live demonstration of evaluating both simple and complex Kubernetes label policies within the interactive Rego environment.
1. **Deployment models for co-locating OPA instances** (16:23) — Best practices for embedding OPA as a Go library or running it as a co-located daemon set to minimize latency.
1. **Validating data queries and infrastructure security configurations** (17:11) — How OPA can enforce rules on Elasticsearch queries and validate Kubernetes environments against CIS benchmarks.
1. **Optimizing performance and overcoming Open Policy Agent barriers** (20:51) — Insights into profiling Rego queries to enhance speed alongside the challenges of adopting the complex language ecosystem.
1. **Audience questions on data formats and deployment environments** (24:07) — Responses regarding Rego's support for JSON and YAML alongside non-Kubernetes OPA deployments and API integrations.

## Related Moments

- [Implementing programmatic policy checks with Open Policy Agent](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) (from "A practical guide to writing secure Dockerfiles")
- [Usability and syntax challenges with rego and opa](https://www.wearedevelopers.com/videos/532-policy-as-versioned-code-you-re-doing-it-wrong) (from "Policy as [versioned] code - you're doing it wrong")
- [Expanding Open Policy Agent across diverse ecosystems](https://www.wearedevelopers.com/videos/35-decoupled-authorization-using-policy-as-code) (from "Decoupled Authorization using Policy as Code")
- [Uploading and evaluating Open Policy Agent rules dynamically](https://www.wearedevelopers.com/videos/35-decoupled-authorization-using-policy-as-code) (from "Decoupled Authorization using Policy as Code")
- [Defining and evaluating access policies using Rego](https://www.wearedevelopers.com/videos/35-decoupled-authorization-using-policy-as-code) (from "Decoupled Authorization using Policy as Code")
- [Replacing verbose XACML with Open Policy Agent](https://www.wearedevelopers.com/videos/35-decoupled-authorization-using-policy-as-code) (from "Decoupled Authorization using Policy as Code")

## Related Articles

- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [The Future of Open Source: A Deep Dive - Scott Chacon at WeAreDevelopers World Congress 2024](https://www.wearedevelopers.com/magazine/471-the-future-of-open-source-a-deep-dive-scott-chacon-at-wearedevelopers-world-congress-2024)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [MLops – Deploying, Maintaining And Evolving Machine Learning Models in Production](https://www.wearedevelopers.com/magazine/115-mlops-deploying-maintaining-and-evolving-machine-learning-models-in-production)

## Related Jobs

- [Senior Cloud Native Solution Architect (all genders welcome) - Kubernetes, CNCF, MlOps](https://www.wearedevelopers.com/jobs/ext/101488-senior-cloud-native-solution-architect-all-genders-welcome-kubernetes-cncf-mlops) at **Rosenxt Group**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**
- [Platform Engineer - Mercury Runtime Platform](https://www.wearedevelopers.com/jobs/ext/293235-platform-engineer-mercury-runtime-platform) at **Raiffeisen Bank International AG**
- [Cloud-Native Architect (all genders welcome) - Kubernetes, CNCF, MLOps](https://www.wearedevelopers.com/jobs/ext/101479-cloud-native-architect-all-genders-welcome-kubernetes-cncf-mlops) at **Rosenxt Group**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1998712-endpoint-security-engineer-ot) at **ZEISS Group**