PolicyReport CRD: Manage Admission Control, Runtime, and Scan Reports!
summary
PolicyReport CRD standardizes outputs from multiple engines so a single cluster can hold unified findings instead of scattered logs. Adapters map Falco (via Falco Sidekick), Trivy, kube-bench (runs as a nested CronJob), KubeArmor and Kyverno results into PolicyReport CRD objects producing per-namespace and cluster-wide reports; mappings are configurable and event limits are enforced. A dashboard and metrics endpoint called Policy Reporter UI converts CRs to alerts and sends notifications to Slack, Grafana, Teams, Elasticsearch and others. kube-bench adapter automates the former manual CIS run and updates ClusterPolicyReport objects.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 2:36Policy report architecture
- 4:23Cube bench adapter
- 8:50Trivy adapter
- 13:34Falco adapter
- 18:07Policy reporter UI
- 24:35Outlook and community
- 26:43Q&A session
related talks
24mUnifying Policy Observability in Kubernetes
26mUnifying Policy Observability in Kubernetes
27mPolicy Matters! The Why, What, and How of Kubernetes Policy Management
36mKubernetes Policy, Governance, And Compliance: A WG Policy Update
46mKubernetes Policy WG Deep Dive
06mLightning Talk: Why Your Cluster-Wide Policies Are a Risk (And What To Do About It)
36mCentralized Policy Management
35mHow to fight misconfiguration and bad intentions with Kubernetes admission policy