How to fight misconfiguration and bad intentions with Kubernetes admission policy
summary
Kubernetes now includes Validating Admission Policy (beta, heading toward GA) and works through admission controller stages: auth, mutation, schema check, then validation. Native policies run per resource so a simple rule like <=5 replicas fails across an application when HPA or dozens of CRDs intervene. Demo uses Crossplane to expose a single SQLClaim CRD, deny direct low-level cloud resources, and enforce size rules — the demo refuses a small size and succeeds after changing to medium.
AI-written summary · about
chapters (8)
- 0:00Kubernetes admission policies intro
- 7:48How validating admission works
- 11:08Why simple policies fail
- 16:13Context for effective policies
- 19:49Simplifying policies with custom resource definitions
- 27:05Live demo: policy enforcement
- 27:27Q&A: retroactivity & access
- 31:47Closing remarks
related talks
30mA Practical Guide To Kubernetes Policy as Code
20mUsing, and mis-using K8s Dynamic Admission Control
25mYour AI Is a Toddler With Root Access: Why Kubernetes Policies Are Your Last Line...
36mCentralized Policy Management
29mEVAPorating Kubernetes Security Risk: Adopting Validating Admission Policy at Scale
29mCompliance in Kubernetes: Enforcing and Visualizing
32mCloud Native Policy as Code: Principles and Best Practices
33mBringing Pod Security Admission to Your Kubernetes Distribution