How To Fight Misconfiguration And Bad Intentions
summary
Shows how an Internal Developer Platform built with Crossplane uses Kubernetes Validating Admission Policy to enforce concrete rules: example policy blocks deployments with more than 5 replicas; namespace bindings apply a cluster-wide allowlist (small|medium|large) while the production binding allows only medium|large and Postgres versions 13 or 14. Demonstrates replacing dozens of per-resource policies with one higher‑level custom resource (SQL claim / composition) so validation has full context; demo manifests either pass or are rejected as expected, proving the approach works.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:45Validate Kubernetes configs
- 2:11Admission controllers in Kubernetes
- 6:27Validating admission policies
- 9:17Limitations of resource-level enforcement
- 13:09Context gaps in validation
- 15:38Crossplane compositions for control
- 19:54Implementing policies with Crossplane
- 23:26Live demo of enforcement
- 24:08Q&A
related talks
27mk8s Validating Admission Policy And Crossplane - Viktor Farcic
26mPolicy as Code: Past, Present and Future for Novice
24mOne stop talk for kubernetes security !!
30mA Practical Guide To Kubernetes Policy as Code
06mLightning Talk: Why Your Cluster-Wide Policies Are a Risk (And What To Do About It)
27mPolicy Matters! The Why, What, and How of Kubernetes Policy Management
37mHandsOn PodSecurity Policies
20mTrust but Verify