Policy as Code: Past, Present and Future for Novice
Talkat KubeCon + CloudNativeCon China 2025 · on Wednesday, 2025-06-11· at 15:30· Level 16 | Grand Ballroom I·
summary
Timeline and concrete commands show Policy as Code moving into core Kubernetes: CEL lands around v1.23, Validating Admission Policy GA v1.30 and Mutating Admission Policy Alpha v1.32 let policies run inside the API server without external webhooks or Gatekeeper. Live demos apply YAML with kubectl -f to block hostNetwork: true, deny hostPath mounts, and enforce replicas >= 2, illustrating exact CEL expressions, ClusterPolicy/ClusterPolicyBinding-style objects, and how mutation can inject safe defaults.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:50What is policy as code
- 4:16Why use policy as code
- 5:59Policy in Kubernetes and cloud
- 9:54AI and future of policy as code
- 10:17History of policy in Kubernetes
- 13:33Current state of policy in Kubernetes
- 16:46YAML and policy similarities
- 18:52Live demo
- 20:15Host network validation
- 20:56Volume validation
- 21:59Replica validation
- 23:02Future of policy in Kubernetes
- 24:25Resources
- 25:08Q&A
related talks
30mA Practical Guide To Kubernetes Policy as Code
27mPolicy Matters! The Why, What, and How of Kubernetes Policy Management
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
37mDeep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in Action
20mDeep Dive: Kubernetes Policy WG
34mHow To Fight Misconfiguration And Bad Intentions