Talk Deep Dive
summary
Explains why PodSecurityPolicy is limited and shows a working tool called kube-policy-advisor that auto-generates Rego policies from existing PSPs, targets create and update admission events via the Kubernetes API server, and can migrate PSP to OPA/Gatekeeper to preserve current controls. Demonstrates policy generation, discusses Rego learning curve, plans to expand policy types, and notes runtime detection remains a separate problem handled by other CNCF tools; the demo shows it actually produces usable OPA policies.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:30Who will be writing these policies
- 4:45Gatekeepers
- 5:35Policy Advisor
- 6:35Dynamic Analysis
- 9:15Security in Kubernetes
related talks
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
20mDeep Dive: Kubernetes Policy WG
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
37mHandsOn PodSecurity Policies
39mOPA
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)
30mPod Security as an Afterthought