Policy as [versioned] Code - How to do it Right
summary
Claim: store policies in Git, version them like libraries, test them, and let tooling update consumers automatically. Implementation: example GitHub org with policy artifacts, signed tags, release notes, tests, and a bash shim so local and CI can run policy checks; demos use Terraform and Kubernetes with Checkov + Kyverno, automated PRs via Renovate/Dependabot, and cluster evaluation using kind. Outcome: multiple policy versions coexist, repos auto-create update PRs, teams can push policy as dependency updates under semantic versioning and measure compliance.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 4:50What policy as code can do
- 8:21Why we do policy as code wrong
- 10:50Version control for policies
- 13:17Testing and dependency management
- 15:25Live demo with Terraform and Kubernetes
- 19:35Policy with context and rationale
- 20:39Culture change and next steps
- 21:20Summary and closing
related talks
25mPolicy as [versioned] Code
30mGitops with Policy As Code and OPA
23mSecure Your Systems the Better Way Using Policy-as-Code
30mEnhance your Compliance with Policy-Based CI/CD
43mEmpowering The Guardians Of Your Code Kingdom
36mCentralized Policy Management
30mA Practical Guide To Kubernetes Policy as Code
26mSlowing Our Role: Moving Towards Policy at Plex