Network Policy Nirvana: Automating Security & Self-Service...
summary
Demonstrates automating network policy lifecycle with Kyverno and Cilium: eight Kyverno policies (four generate actual Cilium NetworkPolicies) enforce auto-label inheritance (workspace + tier), block creation of unlabeled namespaces and disallowed images, and auto-create/delete a namespace-scoped deny-all plus allow-DNS toggle. Uses the guestbook app across two workspaces, runs live netcat checks that show intra-workspace traffic allowed and cross-workspace traffic denied, and shows Kyverno rejecting overly permissive policies and unlabelled resources at admission.
AI-written summary · about
chapters (8)
- 0:00Agility versus security
- 2:26Kivero policy engine intro
- 9:07Automating with Kivero and Cilium
- 14:05Live demo setup
- 17:41Self-service DNS policies
- 20:10Cross-workspace segmentation test
- 23:39Recap and benefits
- 24:43Q&A
related talks
05mBeyond Guardrails: Resource Lifecycle Automation With Kyverno
49mKubernetes Policy as Code with Kyverno
09mLightning Talk: Namespaces-as-a-Service with HNC & Kyverno!
06mProject Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle
27mPolicy-Based Infrastructure as Code with Kyverno
31mKubernetes Native Policy Management with Kyverno!
32mCloud Native Policy as Code: Principles and Best Practices
35mTurn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid