Lightning Talk: Why Your Cluster-Wide Policies Are a Risk (And What To Do About It)
summary
Kubernetes policy enforcement moves from cluster-wide CEL webhooks to namespace-scoped CRDs: Kyverno implements five namespace-scoped policies (validating, mutating, generate, etc.) aligned with ValidatingAdmissionPolicy and MutatingAdmissionPolicy. Cluster-scoped rules require cluster-admin RBAC, risk a cluster-wide misconfiguration and force checks across every namespace; namespace scope reduces blast radius and improves admission latency, simplifies permissions for tenant owners, and lowers management overhead while keeping existing Kyverno semantics.
AI-written summary · about
related talks
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
31mKubernetes Native Policy Management with Kyverno!
28mBeyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
49mKubernetes Policy as Code with Kyverno
32mCloud Native Policy as Code: Principles and Best Practices
06mProject Lightning Talk: Kyverno Lightning Update: CEL & Policy Types in Action
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters