Skip to content

Policy-as-code at scale

One cluster’s admission policy is a script; fifty clusters’ policy is a product. Learn Rego properly, unit-test policies in CI, choose between Kyverno and Gatekeeper deliberately, run exceptions with expiry dates, and measure enforcement across CI, admission, and multi-cluster rollouts.

Advanced4 sections · 13 lessons · ~7h total · 14-question self-test

01

Rego foundations

4 lessonsTest yourself

01OPA architecture and the Rego mental modelQueries over documents, not scripts.35 min 02Documents, data, and packagesinput, data, and how Rego loads the world.30 min 03Writing testable Regoopa test, fixtures, and coverage.35 min 04Deny-by-default patterns that scalePartial sets, helpers, and reusable libraries.30 min

02

Engines & Kubernetes

3 lessonsTest yourself

01Kyverno vs GatekeeperChoosing an engine per constraint, not per fashion.30 min 02Gatekeeper ConstraintTemplates at scaleTemplates, constraints, and syncing data.30 min 03Kyverno mutate, generate, and verifyImagesMore than validate — fix and prove provenance.30 min

03

Lifecycle & enforcement

4 lessonsTest yourself

01Policy lifecycleVersioning, rollout waves, ownership.30 min 02Exceptions with expiryBreak-glass that closes itself.25 min 03Enforcement pointsThe same policy in CI, admission, and audit.30 min 04CI parity with Conftest and opa evalCatch violations before the cluster sees them.30 min

04

Scale & measurement

2 lessonsTest yourself

01Multi-cluster distributionGitOps, bundles, and wave rollouts.30 min 02Measuring policy effectivenessFindings, SLOs, and when to retire a rule.25 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

14 questions drawn from all 4 sections — every answer explained as you pick.

Start final exam