Kubernetes Policy as Code for Platform Engineers
summary
Platform engineers get concrete recipes using Kyverno 1.15 as a dynamic admission controller plus Chainsaw tests and a CLI: mutating policies auto-add labels, validate rules enforce CPU and memory limits, imageValidation blocks untrusted registries (cosign attestation assumed), and a JSON-policy rejects Terraform plans that enable public EKS endpoints. Policies run at admission and in background, support CEL expressions for migration, can auto-generate ConfigMaps on namespace create, and the demos show enforcement, testable simulation, and CI integration working end to end.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:47Cluster access risks
- 5:05Guardrails for Kubernetes
- 6:09Insecure pod demo
- 9:02Why policy as code
- 11:32Kyverno introduction
- 13:20Kyverno vs native policies
- 14:46Kyverno vs VAP comparison
- 16:13Testing policies with Chainsaw
- 17:17How Kyverno works
- 18:21Kyverno 1.15 new policies
- 20:10Pod label policies
- 21:35Resource governance policies
- 22:39Image validation for security
- 23:42Terraform plan validation
- 25:47Migrating to CEL expressions
- 28:24Policy migration demo
- 30:34Chainsaw test results
- 31:57Kyverno roadmap
- 32:59Q&A
related talks
24mKyverno Mutating Policies: Shifting Platform Logic Into the Control Plane
37mKubernetes Wonderland: Adventures in Platform Building
32mKubernetes as a platform for platforms
28mValidating Configs from Code to Deployment in the GitOps World
31mIntro: Kubernetes Policy WG
32mYAML Your Cloud! Managing Your Hosted Resources With Kubernetes
22mNavigating the No-Code to Full-Code Spectrum - a Platform Engineering Journey
14mKeynote: Kubernetes: The Video Game