Deep Dive: Kubernetes Policy WG
summary
Kubernetes Policy WG outlines concrete work: standardizing policy semantics and control mechanisms rather than a language, piloting multi-tenancy by defining tenant resources and population constraints, and evaluating gatekeeper + OPA to replace PodSecurityPolicy. Planned experiments include formal verification with SMT solvers using symbolic graphs for domains like networking and privilege escalation, with collaborators from AWS automated reasoning and JP Morgan. Outputs targeted for the year are a cloud native policy white paper, prototype constraint CRDs, and an evaluation of WASM support for policy enforcement.
AI-written summary · about
chapters (9)
- 0:00Motivation (from Brian G)
- 0:43Motivation (from ourselves)
- 3:06Overview (SIG Relationship)
- 4:02Policy WG Work Items Overview
- 4:46WG Running List 2019 - Multi-Tenancy Policy
- 7:15WG Running List 2019 - OPA Gatekeeper Project
- 9:25WG New Area Exploration - policy formal verification
- 12:58WG New Area Exploration - policy as type system
- 14:47CNCF Security SIG - Cloud Native White Paper
related talks
26mIntro + Deep Dive: Kubernetes Policy WG
46mKubernetes Policy WG Deep Dive
20mDeep Dive: Kubernetes Policy WG
35mDeep Dive: Kubernetes Working Group for Multi-tenancy
24mOne stop talk for kubernetes security !!
12mTalk Deep Dive
37mDeep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in Action
36mBuilding a universal policy platform for Kubernetes - Victor Cuadrado Juan