Say goodbye to PSP! Migrate your PSP rules to OPA with no hassle
summary
PSP is scheduled for removal in Kubernetes 1.25 and this shows an automated migration path: kube-policy-advisor scans a live cluster or a single YAML and runs inspect/convert to emit Rego policies, including support for pods, deployments and daemonsets, with a deny-by-default option. Generated Rego is loaded as a ConfigMap for the OPA admission webhook and the demo rejects a noncompliant pod while allowing a compliant deployment.
AI-written summary · about
chapters (4)
- 0:00Start
- 3:26aspects of the pod specification • Define a set of conditions that a pod must satisfy with in order to be accepted into the system
- 11:29Why OPA is the answer • Could be used to check all the fields • Deployed to Kubernetes as an admission controller - Applied to any Kubernetes resource • User extensible to cover any area
- 16:14Easy way to create PSP and OPA Policies ready to use . Generate policies from live kubernetes environments • Generate policies offline using a single yaml file • Generate policies for single namespaces to narrow down security contexts
related talks
35mMigrating From PodSecurityPolicy
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith Nambiar
39mApplying Policy Throughout The Application Lifecycle with Open Policy Agent
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)
26mReplacing PSPs? Keep Bad Pods out of your cluster using Kyverno!
39mOPA
34mFine-grained Authorization in a Containerized World
45mOPA Deep Dive