Cloud Native Policy as Code: Principles and Best Practices
summary
Cloud-native policy here means declarative Kubernetes configs that manage other configs; Kyverno is shown running as an admission controller, offering mutate + validate rules, image verification rule, background scans and a TTL cleanup that deletes resources. Demoed lifecycle includes six phases (develop, test, distribute, enforce, observe, manage), unit tests via the CLI (kerno test) and end-to-end Chainsaw, GitOps distribution, audit vs enforce modes, Prometheus/Grafana metrics, and the claim that production clusters average ~300 misconfigurations.
AI-written summary · about
chapters (11)
- 0:00Policy as code intro
- 2:18Policies in Kubernetes
- 5:49Policy as code importance
- 10:44Keno policy engine
- 13:53Keno features and use cases
- 18:29Policy lifecycle phases
- 20:14Developing Keno policies
- 25:24Distributing policies
- 27:37Policy compliance metrics
- 29:45Managing policy changes
- 30:44Q&A
related talks
31mKubernetes Native Policy Management with Kyverno!
06mProject Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters
46mKyverno: Compliance Inside Your Kubernetes Cluster
27mUnderstanding Kyverno in a Visual Way
37mKyverno Introduction And Overview
39mKyverno Playground: Make Policy Testing a Breeze and Enjoy the Process!
35mShift-Left Policy Validation in Kubernetes With Kyvern...