Deep Dive: Open Policy Agent - Torin Sandall, Styra

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Open Policy Agent - Torin Sandall, Styra
As OPA adoption has grown, it has been applied to a variety of use cases like microservice API authorization, admission control, risk management, and more. In each case, OPA is used to render a definitive decision policy decision that is represented as a JSON value like "true" or "false". Earlier this year we added Partial Evaluation which gives OPA the ability to return conditional policy decisions in the form of simplified policy statements. This session explains how Partial Evaluation works and how you can integrate it into your services. The session is aimed at existing users (or people already familiar with OPA) who are interested in applying OPA to new usecases like data filtering and end-user authorization.
To learn more: sched.co/Grdg

[@saikatdutta9948]

How do you implement the plugin in VSCode. Downloaded "Open policy agent" plugin in vscode but not able to use it. Do you have any youtube video?

[@gregorycook5305]

Great deep dive sir.

[@miomao8321]

the video image is too poor, you need to fix it more

[@jasontruter7239]

How would we implement OPA in Serverless Framework with GraphQL Microservices?

what is happening at 17:40?? as he scrolls, "test allow negative" changes to "test_allow negative" and back? WTF???

[@jx6773]

lighting lol

[@kamesh7818]

very useful, thanks for sharing.

[@mattschurenko3032]

So “=“ is being used for an equality test and not for assignment? That is a really poor design decision which will no doubt confuse anyone new to the language. I think the idea of OPA is great but the Rego syntax is really unfortunate.

[@missingfaktor]

Based on my very limited understanding: It's an unification operator from logic programming. Yes, `2 = 2` evaluates to true. But if you write `2 = x`, and `x` didn't exist yet, then it will introduce a binding `x` with value `2`. `x = 2` will have the exact same effect. `2 = 3` doesn't evaluate to false but assumes there was no decision.

[@arifpratama5662]

cool

[@myasnik4myasnik485]

what does the string data.pets[pet]?