Policy-as-code for Kubernetes with Gatekeeper
summary
Gatekeeper installs OPA as a Kubernetes admission controller using Gatekeeper CRDs and a validating webhook, stores reusable Rego templates as constraint templates, and lets you instantiate policies as constraints. Demo shows applying a required-labels template, Datadog auto-detects Gatekeeper and surfaces policy metrics on a Datadog dashboard, and the audit controller reports 14 existing pod violations rather than deleting them; new pods without the label are rejected until fixed. A mutating webhook is listed as work in progress.
AI-written summary · about
chapters (4)
related talks
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
34mGatekeeper: Flexible, Shareable Policy for Kubernetes
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
35mEnforcing Service Mesh Structure using OPA Gatekeeper
32mSecuring our clusters with gatekeeper and OPA
41mYou Shall Not Pass! Policy Compliance with OPA Gatekeeper