Policy as Code

Chapter 5. Open Policy Agent and Kubernetes

So far, we have explored PaC as a general subject, with a focus on foundational knowledge. In Chapter 2, I introduced you to Open Policy Agent (OPA), and we examined the OPA suite of tools. We explored how to write, test, and manage policies as well as how to extend and integrate with OPA. In Chapter 3, we looked into PaC and AuthZ, and again we reviewed examples of how OPA can be used in those use cases. Finally, in Chapter 4, I covered the different features, components, and use cases with which PaC is used within Kubernetes clusters.

Over the next several chapters, we will explore specific PaC solutions and how they are used within Kubernetes clusters to satisfy mutating and validating use cases. Along the way, I will expose you to best practices and potential challenges. In these chapters, you should learn how each PaC solution that I cover in this book best fits your needs and capabilities.

In this chapter, I will cover OPA and Kubernetes. As described in Chapter 2, OPA is a domain-agnostic PaC solution that evaluates Rego policies against submitted and stored data. I will start with the installation and components; then, I will dive deeper into Kubernetes-specific OPA policies, libraries, tools, and techniques.

Note

In this book, I may refer to OPA—not OPA/Gatekeeper—as OPA classic. I add the classic moniker to differentiate OPA from OPA/Gatekeeper.

OPA is a very mature OSS project with a strong and active community of developers ...