Embracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
summary
Explains how OPA + Gatekeeper enforce concrete Kubernetes rules by applying Gatekeeper CRDs and reusable constraint templates from the Gatekeeper library; demo shows Minikube install, a three-replica controller, and immediate webhook denials when a Pod lacks the required stackconf label and when two Ingresses share a hostname. The audit pod finds preexisting violations so fixes can be staged, and built-in Datadog metrics report webhook latency, request rate and violation counts in real time, proving the policy-as-code flow works end to end.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:22Policy as Code in Kubernetes
- 0:51What What Is Kubernetes
- 6:10How Does Gatekeeper Work
- 7:04Admission Controllers
- 10:15The Gatekeeper Library
- 11:51Metrics
- 12:56Demo
- 13:52Deploy Gatekeeper
related talks
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
14mPolicy-as-code for Kubernetes with Gatekeeper
34mGatekeeper: Flexible, Shareable Policy for Kubernetes
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
41mYou Shall Not Pass! Policy Compliance with OPA Gatekeeper
32mSecuring our clusters with gatekeeper and OPA
10mThe Power of OPA Gatekeeper: Enforcing Kubernetes Access Control to secure your runtime