Enabling Autonomous Teams With Policy Enforcement at Yubico

on YouTube ↗38m

" summary

Yubico replaces slow, manual RBAC reviews with automated policy enforcement using Open Policy Agent and cluster admission via Gatekeeper, plus local and CI checks with comptest and a small tool called constraint that generates gatekeeper templates and docs. A GitOps pipeline promotes policies in dry-run then enforcement, policies run audit reports across all clusters, and GitHub Actions surface violations as PR comments; outcome: gatekeeper runs in every cluster and progressive enforcement is working.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 3:38About peer review...
3. 25:07What went wrong?
4. 30:26Policy Promotion Strategy • Work on remediating one policy at a time
5. 32:08GitOps Approach

" related talks

• 28mHow To Automate Your Governance Strategy for Hundreds of Kubernetes ClustersMichael Kotelnikov · KubeDay Israel 2023
• 36mCentralized Policy ManagementNoaa Barki · NDC Security 2022
• 37mDeep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in ActionNoaa Barki, Shimon Tolts · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 30mGitops with Policy As Code and OPAPeter ONeill · DevOpsDays Atlanta 2022
• 37mDeep-dive into Open Policy Agent + Conftest + GateKeeperNoaa Barki · Conf42 Cloud Native 2022
• 34mGatekeeper: Flexible, Shareable Policy for KubernetesCraig Peters · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 33mGoverning the Ungovernable: Security and Compliance for AI Agents in Open Source Projec...Ronit Raj · Open Source Summit India 2026
• 30mSecuring the Kubernetes Empire with OpenPolicyAgent and RegoNavin Pai · KubeDay India 2023