Falco: Integration with OPA (Open Policy Agent)

[fntlnz]

OPA - Open Policy Agent can be used at different levels of the stack and is not intended only for application business logic but also for other levels.

Said that, we want to find ways to integrate OPA with Falco by farming off policy decisions that can then be converted to falco rules.

For example, an OPA policy might be "limit what Kubernetes users can instruct the cluster to use specific image", Falco can read that policy and put in place the action with a Rule.

[leodido]

/kind design
/kind feature

[amuniz]

I might be wrong, but I think @kris-nova just demoed something like this today at FOSDEM. Is this about a deeper integration?

[wilf1rst]

I might be wrong, but I think @kris-nova just demoed something like this today at FOSDEM. Is this about a deeper integration?

Here's the talk
http://bofh.nikhef.nl/events/FOSDEM/2020/K.1.105/kubernetes.webm

I'd like to find her project to deeply understand the gatekeeper OPA rules and have examples

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.