Kubernetes Policy as Code with Kyverno
summary
Kyverno is a Kubernetes-native policy engine that runs as an admission controller, stores policies as Kubernetes resources, and enforces mutate/validate/generate rules. It auto-replaces image tags with digests and blocks unsigned images via image verification with cosign, can auto-create a default deny NetworkPolicy on new namespaces (generate default deny NetworkPolicy), reads ConfigMaps and the API server with JMESPath expressions, exports Prometheus metrics, emits standardized policy reports as CRDs (reports as CRDs), and provides a CLI and tests; project is at 1.4 moving toward 1.5.
AI-written summary · about
chapters (16)
- 0:00Start
- 2:17What policies can do for you
- 3:14Being Kubernetes Native
- 10:00The XACML reference architecture
- 11:05Applying XACML to Kubernetes
- 17:18Mutate Policy
- 18:12Generate Policy
- 18:58Image Verification Policy
- 20:29Variables
- 23:44External Data: Config Maps
- 24:53External Data API Server Lookups
- 30:42Policy Reports
- 33:10Policy Metrics
- 33:46Grafana Dashboard
- 36:43Major Features
- 48:36Join the Kyverno Community
related talks
31mKubernetes Native Policy Management with Kyverno!
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
28mBeyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
46mKyverno: Compliance Inside Your Kubernetes Cluster
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters
27mUnderstanding Kyverno in a Visual Way
42mBehold: A New Way to Deploy Pod Security Policies Using Kyverno!