Kyverno Chronicles: A DevSecOps Tale
summary
Kyverno runs as admission webhooks and enforces or audits policies like mutate imagePullSecret to inject registry credentials, verify image with cosign to reject unsigned images (demo: deployment fails for unsigned latest, succeeds when signed by digest), and generate default-deny NetworkPolicy when namespaces are created. Examples include blocking images older than six months, reducing CPU requests by 10% via mutation, and syncing a secret into new namespaces. Notes HA risk: webhook downtime blocks API calls; external checks can be set to fail or ignore.
AI-written summary · about
chapters (15)
- 0:00Introduction and welcome
- 1:49Kubernetes architecture overview
- 5:25Admission controllers explained
- 6:08What is Kyverno?
- 8:55Kyverno policy workflow
- 11:07High availability and fail policies
- 13:17Policy examples and enforcement
- 18:24Validation admission policies
- 19:06Installing Kyverno demo setup
- 21:41Private registry integration
- 22:22Synchronizing secrets across namespaces
- 23:51Private registry deployment fix
- 25:16Supply chain security with Kyverno
- 27:24Image verification and mutation
- 28:29Closing and Q&A
related talks
49mKubernetes Policy as Code with Kyverno
31mKnow Your Hard:Automate image security scan with Kyverno & Trivy
27mUnderstanding Kyverno in a Visual Way
37mKyverno Introduction And Overview
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
28mBeyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
46mKyverno: Compliance Inside Your Kubernetes Cluster
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring