Securing our clusters with gatekeeper and OPA
summary
Shows how Gatekeeper + OPA enforce policies Kubernetes RBAC cannot, using Rego constraint templates to block undesired services (no NodePort or LoadBalancer) and validate Ingress hosts. Describes a Helm “Landlord” that bootstraps tenants and creates an authorized-domain constraint, runs opa test unit checks, and demo denies an unauthorized host. Deployed to just over 55 tenant namespaces with Flux GitOps managing configs; policies are applied at admission time and the enforcement works live.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:31About Me
- 3:07The Common Application Platform
- 4:31The Original Goals in Human Terms
- 6:42Designing for Multi-tenancy
- 8:09Built-in RBAC Mechanisms
- 8:51Roles/Role Bindings
- 10:23Example Role/RoleBinding
- 11:27Built-in RBAC Limitations
- 14:14A few built-in Admissions Controllers
- 14:48Adding your own admission plugins
- 15:49Example Configuration
- 16:28Example Request Responses
- 17:42Open Policy Agent OPA and Gatekeeper
- 18:53OPA Policies
- 21:22Example Constraint
related talks
30mSecuring the Kubernetes Empire with OpenPolicyAgent and Rego
35mEnforcing Service Mesh Structure using OPA Gatekeeper
34mEmbracing Change, Policy as code for Kubernetes with OPA and Gatekeeper
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
39mCreating A Landlord for Multi-tenant K8s Using Flux, Gatekeeper, Helm, and Friends
14mPolicy-as-code for Kubernetes with Gatekeeper
25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA)