Does it make sense to create a Bundle for loading into OpenPolicyAgent which contains a data.json file with a /giant/ list of both Principals (fediverse handles, email addresses) and Resources (documents, meetings) they Own (can modify)?
Document-ownership kinda sounds Dynamic. But there's no numbers for size/freq (just "medium") in https://openpolicyagent.org/docs/external-data
(Is this what OPAL does?)
(Unknown whether a principal list should just be implied by resource-rights.)
I love spacelift.io for a number of reasons, namely it saves you from running #Terraform or #OpenTofu in whatever "CI" tool your company uses this week (been there, hated it) and doesn't cost an arm, leg and kidney that Terraform Cloud charge you (loved TFC until that switcharoo).
Anyway, I've been wrapping up a thing I've been working on. Many SaaS tools allow you to send #webhooks, but rarely give you control over if, where and what is sent. Now #Spacelift let you control all of this using a Policy based on #OpenPolicyAgent.
SL provide an event, you develop your policy in the #Rego language, not only can you use that policy to decide: Is this an event I want to send a webhook for? But more than that, you can use the policy language to craft the exact payload. Since you may not get a choice of what that looks like on the other end.
Docs: https://docs.spacelift.io/concepts/policy/notification-policy
Now that's just for notifications etc. You can control almost anything within the tool: Logins, Plans, Triggers, Pushes and more.
Using or trialling OPA? We want to hear from you in our 2025 Community Survey.
https://www.surveymonkey.com/r/SCBSDZN
Whether you're new to OPA or have been on the Rego train for years, hearing about how you use OPA projects will help us share OPA for the months and years to come.
We're going to be at KubeCon tomorrow in the project pavilion. Come and say hi!
Note from Teemu, Tim, and Torin to the #OpenPolicyAgent community
Skipper deployed as ingress in your #kubernetes cluster and #OpenPolicyAgent as rule engine got a significant speedup https://github.com/zalando/skipper/releases/tag/v0.22.51
Blue line “old” Red line “new”
Great blog from Square, on how they built a custom solution for #Kubernetes guardrails on top of Open Policy Agent. This is a perfect example of the flexibility OPA provides organizations to solve the most advanced use cases!
https://developer.squareup.com/blog/kube-policies-guardrails-for-apps-running-in-kubernetes/
The #KubeCon recordings are now on YouTube! We'll be posting links to all the #OpenPolicyAgent related ones as we watch them. First out is the #OPA maintainer track session, where @charlieegan3 and @anderseknert give a short introduction to OPA and Rego, followed by a deep-dive into recent performance improvements, and a sneak peek at the project roadmap. Check it out!
For anyone at #KubeCon, me and @charlieegan3 will close the day off by presenting an introduction, deep-dive and roadmap for #OpenPolicyAgent at 17:30. I know it’s late, but stick around, as we have a lot of cool things to show you!
https://kccnceu2025.sched.com/event/1td0h/open-policy-agent-opa-intro-deep-dive-charlie-egan-styra
Today I was in the mood and packaged #regal and #opa for @opensuse
Packages still need more testing, but the first steps are done. Found a glitch in the OPA ldflags handling and reported it upstream.
Should arrive in #Tumbleweed soon-ish.
9 years. I guess we’re doing this..
Dependency Management Data's Open Policy Agent support is now a whole lot more efficient
Talking about the latest release of Dependency Management Data and some refactoring that's led to better performance.
https://fed.brid.gy/r/https://www.jvt.me/posts/2024/07/27/dmd-opa-perf/
Dynamically querying EndOfLife.date data for internal packages with Open Policy Agent and Dependency Management Data
How you can retrieve End-of-Life data via EndOfLife.date using Dependency Management Data's Policies functionality.
https://fed.brid.gy/r/https://www.jvt.me/posts/2024/07/14/dmd-opa-eol/
Avec Thomas Foubert, nous découvrons le Policy as Code (PaC) qui permet de définir et appliquer programmatiquement des politiques/contrôles sur les déploiements.
💻 Avec des outils comme OPA, on peut industrialiser audits & validation de conformité dès les pipelines de déploiement cloud!
#CloudSecurity #AutomationCloud #OpenPolicyAgent
🎧 Web: https://bit.ly/3wAe9xi
🎧 Spotify: https://spoti.fi/4bFQkms
🎧 YouTube: https://bit.ly/4bFQjPq
We also saw community-driven efforts to support CI, binaries, and containers for the Eventing #Kafka Broker receiver & dispatcher (containers), #OpenPolicyAgent's Conftest (ci, binaries), #Skupper (ci, binaries), #Goss (ci, binaries), & rotobuf-maven-plugin (ci) 🎉
At last! Our #KubeCon talk "Open Policy Agent — Intro and Deep Dive" is now up on YouTube 😃 I can't stand hearing / watching myself talk, but hopefully you won't feel the same aversion. Covering an intro to the project, some updates, a roadmap, and much more. Check it out!
Good morning from #KubeCon! If you’re here and want to meet, find me in the #OpenPolicyAgent kiosk in the project pavilion. Also, don’t miss my talk on today at 15:25 if you’re curious about #OPA, #Rego, and anything related.
Межсервисная авторизация в Авито PaaS
Антон Губарев, инженер в Avito PaaS, рассказал, как реализовать межсервисную авторизацию на 2500 сервисов и ничего не сломать.
Anyone have a good write up/how-to for standing up #OpenPolicyAgent server? Looking at the documentation, I'm a bit lost on how to point it to rego files, and how to have my clients call OPA to evaluate their JSON.
My use case is kind of fun - have all my team's Terraform repos do a pre-merge OPA evaluation on the Terraform plan. I'd like to get away from bundling the rego with the repos - the developers could just change the accept criteria and hope nobody notices in the pull request.
So success looks like having a rego file on a remote opa server that will allow a user to POST a url with their terraform plan, and get back the results.
Any ideas?
(ping @anderseknert)
@anderseknert This looks really cool - I need to carve out some time at work to dive back into Open Policy Agent. We have a decent little workflow for validating Terraform plans, but I'd love to get it further refined.
Plus, getting a OPA server rather than trusting the engineers/pipeline to validate their own policy would be nice.
