Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
OPA and cloud resources
Search
Toshinori Sugita
July 07, 2021
Technology
0
13k
OPA and cloud resources
Open Policy Agent Rego Knowledge Sharing Meetup
https://mercari.connpass.com/event/211073/
Toshinori Sugita
July 07, 2021
Tweet
Share
More Decks by Toshinori Sugita
See All by Toshinori Sugita
KompalWeather: Serverless Sauna Service with Cloud Run
toshi0607
0
12k
Knativeで作るDIY FaaS / serverless days fukuoka 2019 knative workshop
toshi0607
0
4.7k
Knativeで作るDIY FaaS / serverless days tokyo 2019 knative workshop
toshi0607
4
10k
Knativeへの誘い / Go Go Knative!
toshi0607
3
5.2k
Build serverless application on top of Kubernetes #sdmel19
toshi0607
1
5.9k
Knativeで実現するKubernetes上のサーバーレスアーキテクチャ #CNDT2019 #1E3 / serverless architecture on the top of K8s with Knative
toshi0607
9
14k
技術書典で高めるせんとう力 #エンジニア銭湯 / Tech book fest loves sauna
toshi0607
1
6.6k
Goで学ぶKnative #mercarigo / learning Knative with Go
toshi0607
5
24k
入門 Knative 〜KubernetesとServerlessとの出会い〜 / getting started with knative
toshi0607
8
9.1k
Other Decks in Technology
See All in Technology
疎通2024
sadnessojisan
5
870
Oracle Database Backup Service:サービス概要のご紹介
oracle4engineer
PRO
0
4k
MySQLユーザ会なにやってるの?とおさそいと / たいへんなのw
sakaik
1
120
ロリポップ! for Gamersを支えるインフラ/lolipop for gamers infrastructure
takumakume
0
100
デジタル化・DX推進あるある
y150saya
0
230
20240906_JAWS_Yamanashi_#1_leap_beyond_the_AWS_all_certifications
tsumita
1
220
難しいから面白い!医薬品×在庫管理ドメインの複雑性と向き合い、プロダクトの成長を支えるための取り組み / Initiatives to Support Product Growth
kakehashi
2
130
Azure SQL Database Hyperscale HA レプリカの監視
sansantech
PRO
0
220
React Aria で実現する次世代のアクセシビリティ
ryo_manba
4
950
EitherT_with_Future
aoiroaoino
1
920
contenteditableと向き合う
kikuchikakeru
2
240
エンジニア視点で見る、 組織で運用されるデザインシステムにするには
shunya078
1
270
Featured
See All Featured
Optimizing for Happiness
mojombo
375
69k
Scaling GitHub
holman
458
140k
Build your cross-platform service in a week with App Engine
jlugia
228
18k
Put a Button on it: Removing Barriers to Going Fast.
kastner
58
3.4k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
278
13k
The Straight Up "How To Draw Better" Workshop
denniskardys
230
130k
How To Stay Up To Date on Web Technology
chriscoyier
785
250k
Faster Mobile Websites
deanohume
304
30k
Become a Pro
speakerdeck
PRO
22
4.9k
Git: the NoSQL Database
bkeepers
PRO
425
64k
Why You Should Never Use an ORM
jnunemaker
PRO
53
8.9k
A Modern Web Designer's Workflow
chriscoyier
690
190k
Transcript
1 OPA & cloud resources July 7th 2021, Open Policy
Agent Rego Knowledge Sharing Meetup @toshi0607
2 Self introduction • Toshinori Sugita ◦ @toshi0607 • Job
◦ 2018 Merpay ▪ microservice development ◦ 2020 Mercari ▪ microservice platform (platform infra) • Books ◦ 『GCPで学ぶTerraform 基礎編/実践編』 ◦ Knative本 × 3
3 OPA in Mercari • Preparing guardrails for Istio at
scale • Enhance Kubernetes Security with Gatekeeper • Open Policy AgentとSpinnakerで実現するマイクロサービ スの安全な継続的デリバリー • Introduce Conftest
4 OPA in Mercari for Kubernetes • Capabilities • Host
namespaces • Host network • Host path • Privileged container • Wildcard torelations • Dedicated node pool access • Liveness/Readiness prove • Memory request/limit • Pre stop • PDB • HPA • VPA • Datadog Metric • Istio config • DNS config • External IP • Service type
5 Example: Capabilities
6 Example: Capabilities
7 OPA for cloud resources • Domain agnostic and general
purpose policy engine • terraform plan and configuration can be converted to JSON • Conftest supports JSON and HCL/HCL2
8 Differences from use cases for Kubernetes • No gatekeeper
◦ Terraform -> GCP API • Conftest ◦ conftest verify ◦ conftest test
9 Differences from existing Terraform tools • terraform fmt ◦
Terraform style convention • terraform validate ◦ Terraform syntax • terraform-linters/tflint ◦ GCP API compatibility • terraform variable (v0.13~) ◦ General context for input via variable • OPA ◦ General context (reliability, security, company convention, etc.)
10 Use cases • Production readiness check ◦ Cloud SQL
backup, auto resize, maintenance window ◦ Cloud Storage multi-regional, versioning • Terraform module guard rail ◦ Allow list ◦ Service company, country, environment ◦ Module version ◦ Unintended combination
11 Example: Terraform module
12 Takeaways • OPA & Conftest support not only Kubernetes
but also a cloud resource (Terraform) use case • OPA & Conftest covers fine-grained use cases that existing tools don’t support