Kubernetes Policy WG Deep Dive
summary
Six short reports lay out concrete work and gaps: a security profiles CRD implements versioned profiles applied via kubeadm and an admission path (demo populates networkpolicies and rolebindings and activates a default v1.0.0 profile); SIG-auth maps inconsistent policy scopes and proposes firewall-like match+action composition; kube-arbitrator adds QJobs, queues and dominant resource fairness for batch scheduling and preemption; Open Policy Agent offers admission control, bundle downloading and OPA decision logs for audit; Istio Mixer uses adapters and caching; SPIFFE/SPIRE issues SVID x.509 identities with rotation and federation plans.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:35Take a step back...
- 2:53Consistent policy guidelines
- 5:51Use Case: Batch Processing
- 7:24How does arbitrator interact with scheduler?
- 21:46Kubernetes: Admission Control
- 24:31Integrations / Use Cases / Examples
- 25:29New Management Support (v0.8) • Bundle Downloading
- 29:05Istio Authorization Policies
- 31:53Open Questions
related talks
16mDeep Dive: Kubernetes Policy WG
16mDeep Dive: Kubernetes Policy WG
36mKubernetes Policy, Governance, And Compliance: A WG Policy Update
26mIntro + Deep Dive: Kubernetes Policy WG
20mDeep Dive: Kubernetes Policy WG
27mPolicy Matters! The Why, What, and How of Kubernetes Policy Management
12mTalk Deep Dive
37mDeep-dive into Open Policy Agent + Conftest + GateKeeper: Kubernetes Policy in Action