Unifying Policy Observability in Kubernetes
summary
Policy Reporter collects Kyverno validation, Falco runtime events and Trivy image scans into unifies Kyverno Falco Trivy results, deduplicates per-resource CRD noise, and exposes a web UI, Grafana-ready metrics and Slack webhooks so operators see one pane of truth instead of three dashboards. It uses adapters (Falco sidekick, trivy-operator adapter, Kyverno native), supports plugin metadata and custom boards per team, can offload storage to a Report Server, and still lags on engine-specific features.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 3:16Security tools and challenges
- 6:09Kubernetes policy working group
- 7:37Policy report CRD adoption
- 9:21Policy reporter introduction
- 11:11Policy reporter demo
- 17:30Slack notifications setup
- 20:24Summary and tradeoffs
- 23:01Q&A session
related talks
24mUnifying Policy Observability in Kubernetes
23mFull Observability for Kyverno With Observability-as-Code
27mUnderstanding Kyverno in a Visual Way
31mKubernetes Native Policy Management with Kyverno!
30mPolicyReport CRD: Manage Admission Control, Runtime, and Scan Reports!
46mKyverno: Compliance Inside Your Kubernetes Cluster
37mKyverno Introduction And Overview
35mShift-Left Policy Validation in Kubernetes With Kyvern...