Policy as [versioned] Code

on YouTube ↗25m

" summary

Claims that policy becomes a maintainable artifact: put policy in a GitHub repo, semantic versioning it, ship tests, and treat it as a dependency so apps get automated PRs via Renovate. Prototype uses Terraform and Kubernetes with chekkov for Terraform checks and canervo for Kubernetes, tags like 1.00 → 2.00 → 2.1.1, and a small bash shim to run local/CI evaluations. Runtime enforcement uses Kubernetes admission controllers; the proof‑of‑concept works but needs cleaner tooling and cloud vendor integration.

AI-written summary · about

" chapters (9)

1. 0:00Policy pain
2. 6:08Introduction
3. 7:55Policy as code goals
4. 11:47Why policy as code fails
5. 16:40Policy as dependency
6. 17:00Live demo
7. 21:38Policy context
8. 23:22Cultural shift
9. 24:06Purposeful policy

" related talks

• 23mPolicy as [versioned] CodeChris Nesbitt-Smith · SREday London 2022
• 22mPolicy as [versioned] Code - How to do it RightChris Nesbitt-Smith · Spinnaker Summit 2022
• 34mPolicy As [Versioned] CodeChris Nesbitt-Smith · Critical Software Summit @ Open Source Summit Europe 2022
• 10mLightning Talk: Policy as [Versioned] Code - You're Doing It Wrong.Chris Nesbitt-Smith · GitOpsCon North America 2022
• 12mEnd-to-end policy-as-code from IaC to Running WorkloadsMatt Johnson · KubeCon + CloudNativeCon Europe 2021
• 41mModern Policy Management Putting responsibility where it belongsMike Ensor · Build Stuff 2019
• 32mCloud Native Policy as Code: Principles and Best PracticesJim Bugwadia, Sagar Kundral · KCD New York 2024
• 30mA Practical Guide To Kubernetes Policy as CodeJoe Betz, Rita Zhang, Jim Bugwadia, Andy Suderman · KubeCon + CloudNativeCon Europe 2025