Policyfiles
summary
Claims onboarding Devs in a quarter of the time by replacing roles/environments with a concise policyfile.rb (four lines: policy name, source, run_list, exceptions), generating a lock file with a revision id and cookbook checksum that prevents tampering, and promoting policies through a pipeline. Works for air‑gapped sites via export and chef push archive, and bootstraps nodes with policy group/name. Notes a tradeoff: zero‑day mass rollouts are harder by design, favoring controlled, auditable change over instant global pushes.
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 1:53The case for change
- 4:46Overcoming security concerns
- 8:01Collaboration with security
- 11:30Adopting policy files
- 13:48Policy file fundamentals
- 18:30Configuring policy files
- 22:36Managing attributes
- 25:11Lock files and security
- 29:06Air-gapped deployment
- 32:10Implementation and workflow
- 34:51Visibility and support
- 37:10Conclusion and Q&A
related talks
43mPolicy-as-code for Any Cloud to Any Edge Automation
34mPolicy As [Versioned] Code
25mPolicy as [versioned] Code
23mPolicy-driven Deployments in Spinnaker
10mLightning Talk: Policy as [Versioned] Code - You're Doing It Wrong.
26mBuilding Security Into Your DevOps Pipeline
41mManaging the Unmanageable
24mSecurity as Code A SecDevOps Use Case