Compliance in Kubernetes: Enforcing and Visualizing
summary
Kubewarden enforces Kubernetes admission policies compiled to WebAssembly and stores every evaluation as Prometheus metrics so teams can query rejections, mutations and trends. Demo uses three concrete policies—no host namespace sharing, no privileged containers, no run as root—initially in monitor mode then flipped to protect, showing rejected pods when enforced and automatic mutation when configured. Tooling includes Kubewarden (WASM policies), 100% PSP migration coverage and a Prometheus metrics + Grafana dashboard that already reports most rejections coming from host-namespace violations.
AI-written summary · about
chapters (6)
- 0:00Introduction to compliance
- 2:12Policy engines in Kubernetes
- 9:04Demo setup and policies
- 15:52Metrics and Grafana dashboard
- 23:58Enforcing policies in protect mode
- 28:32Conclusion and resources
related talks
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
36mBuilding a universal policy platform for Kubernetes - Victor Cuadrado Juan
03mKubewarden: Leveraging and Extending CEL for your Cluster...
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
40mKubernetes Security After Pod Security Policies Removal
28mKubeArmor: Applying Security Policies with Practical Examples in K8S