OPA & Rego

OPA evaluates policy over JSON. You write rules in Rego, test them, and ask for a decision — in CI with Conftest, or in the cluster with Gatekeeper so a skipped pipeline still gets checked. This course covers deny/allow patterns, data vs input, coverage, admission, bundles, and what to do when the webhook is slow or down. OPA does not replace RBAC, and a policy that never runs in CI will still surprise you at deploy time.