Deep Dive: Kubernetes Policy WG

on YouTube ↗20m

" summary

A Kubernetes policy controller project implements admission-time enforcement plus offline audits by proxying APIServer webhooks into Open Policy Agent and by replicating cluster state into OPA via a kube-management component; policies are written in Rego, can mutate/default fields (labels, owners), and detect cross-namespace ingress hostname conflicts and registry whitelists. Code lives in an Azure repo and is planned to move upstream; it’s alpha but already used by customers, with a roadmap for CRD-driven policy libraries, conflict detection improvements, and scalability testing.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 1:27Admission Control
3. 2:57The Kubernetes Policy Controller
4. 5:50Kubernetes Policy Controller
5. 16:42Standard Policy Interface

" related talks

• 25mPolicing Your Kubernetes Clusters with Open Policy Agent (OPA) - Mark Puddick & Amith NambiarMark Puddick, Amith Nambiar · Kubernetes Forum Sydney 2019
• 19mDynamic Authorization and Policy Control for Your Kubernetes ClusterAsh Narkar · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 16mDeep Dive: Kubernetes Policy WGZhipeng Huang · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 16mDistributed application level RBAC with OPAFederico Maggi · Conf42 Cloud Native 2022
• 34mFine-grained Authorization in a Containerized WorldAsh Narkar · Open Source Summit + Embedded Linux Conference North America 2019
• 36mKubernetes Policy, Governance, And Compliance: A WG Policy UpdateJim Bugwadia, Anca Sailer, Jayashree Ramanathan, Robert Ficcaglia · KubeCon + CloudNativeCon North America 2022
• 12mTalk Deep DiveAndrew Randall, Stefano Chierici · Cloud Native Rejekts NA 2021
• 26mIntro + Deep Dive: Kubernetes Policy WGZhipeng Huang, Erica Von Buelow · KubeCon + CloudNativeCon Europe 2019