Design Patterns for Extendable, Scalable K8s Extensions
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 17:55· Intrado Virtual Event Platform,·
summary
OPA Gatekeeper is an admission webhook that implements CRDs-that-create-CRDs: constraint templates are CRDs that dynamically create constraint CRDs, with unstructured controllers and merged JSON schemas. A dynamic watcher (Oren Shamron’s implementation) removes restarts and duplicated caches. Pods run as a leaderless horizontal scalability web‑troller: each pod serves requests and item‑based controllers use first‑write‑wins. Enforcement visibility uses a by-pod status model with per‑pod constraint status resources aggregated by a singleton, cutting write amplification from potentially O(n^2) to O(n) and relying on Kubernetes GC.
AI-written summary · about
chapters (9)
- 0:00Introduction to Gatekeeper
- 1:03Constraints and templates
- 2:38Duck typing in Gatekeeper
- 5:31Dynamic watch management
- 8:38The constraint framework
- 11:49Extending policy venues
- 13:22The web-troller model
- 17:18Policy enforcement status
- 21:00Scaling and conclusion
related talks
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
34mGatekeeper: Flexible, Shareable Policy for Kubernetes
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
32mSecuring our clusters with gatekeeper and OPA
10mThe Power of OPA Gatekeeper: Enforcing Kubernetes Access Control to secure your runtime
31mKubernetes is Your Platform: Design Patterns For Extens...
05mLightning Talk: CRDs All the Way Down – Using OPA for Complex CRD Validation and Defaulting