Replacing PSPs? Keep Bad Pods out of your cluster using Kyverno!
summary
Kyverno is a Kubernetes-native admission controller that validates, mutates and generates resources to replace deprecated PSPs (PSP deprecated in 1.22 and slated removal around 1.25) and complements PodSecurityAdmission (alpha in 1.22). Demo shows Kyverno rejecting a Deployment missing runAsNonRoot, scanning an existing cluster (policy report: 34 passes, 2 failures), and mutating a created Deployment to inject securityContext. Features include autogen pod-controller rules, policy reports CRD, and mutate defaults via webhook.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:51Pod Security
- 2:36PSP Security Emission
- 5:00PSP Security Recommendations
- 5:30Why use Kyverno
- 7:31Kyverno Policy Library
- 10:21Kyverno Validation Policy
- 10:59Kyverno Autogen
- 11:35Kyverno Enforce Policy
- 14:22Kyverno Policy Report
- 17:19Grandfather Dashboard
- 17:40Mutate Policy
- 24:27Conclusion
related talks
40mKubernetes Security After Pod Security Policies Removal
35mMigrating From PodSecurityPolicy
35mPSP is Dead, Long Live PodSecurity
36mKubernetes Security After Pod Security Policies Removal
42mBehold: A New Way to Deploy Pod Security Policies Using Kyverno!
26mSecure Containers Deployments: Time for Refresh
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
35mPodSecurityPolicy Replacement: Past, Present, and Future