Embracing Change, Policy as code for Kubernetes with OPA and Gatekeeper

on YouTube ↗34m

" summary

Demonstrates policy-as-code using OPA with Gatekeeper: installs Gatekeeper on a kind cluster (three controller-manager pods plus an audit pod), applies a constraint template from the Gatekeeper library, and enforces a required-label rule that blocks an nginx Pod creation until a label is added. Audit mode lists existing violations (demo shows ~17), Gatekeeper exposes validation metrics and a Datadog integration, and templates are reusable across namespaces.

AI-written summary · about

" chapters (14)

1. 0:00Introduction and welcome
2. 2:30What is policy in software
3. 4:15Limitations of RBAC in Kubernetes
4. 6:07Open Policy Agent overview
5. 7:54How Gatekeeper enforces policies
6. 9:44Why Gatekeeper is successful
7. 13:18Common Gatekeeper policy examples
8. 14:41Gatekeeper Library explained
9. 16:24Data-driven policy validation
10. 17:53Observability and metrics in Gatekeeper
11. 18:39Demo setup and overview
12. 20:53Applying required labels policy
13. 26:18Audit mode and existing violations
14. 28:03Q&A session

" related talks

• 28mEmbracing change: Policy-as-code for Kubernetes with OPA and GatekeeperAra Pulido · stackconf online 2021
• 27mEmbracing change: Policy-as-code with OPA and GatekeeperAra Pulido · Conf42 Cloud Native 2021
• 14mPolicy-as-code for Kubernetes with GatekeeperAra Pulido · KubeCon + CloudNativeCon Europe 2021
• 34mGatekeeper: Flexible, Shareable Policy for KubernetesCraig Peters · KubeCon + CloudNativeCon China 2019
• 41mYou Shall Not Pass! Policy Compliance with OPA GatekeeperNiccolò Raspa · KCD Italy 2021
• 32mSecuring our clusters with gatekeeper and OPAMichael Irwin · KCD Washington DC 2021
• 30mSecuring the Kubernetes Empire with OpenPolicyAgent and RegoNavin Pai · KubeDay India 2023
• 34mGatekeeper: Flexible, Shareable Policy for KubernetesCraig Peters · KubeCon + CloudNativeCon + Open Source Summit China 2019