Enforcing Bespoke Policies in Kubernetes [I]
summary
Shows a working external admission webhook written in Go (~150 lines) that blocks kubectl exec into privileged containers in the production namespace, using Kubernetes External Admission Control (dynamic admission webhooks) added in 1.7 and noting 1.9 fixes (mutating hooks, failure-policy). Demonstrates deploying Open Policy Agent as a service, loading policies from ConfigMaps, changing a “break glass” policy at runtime to allow access, and confirms the webhook and OPA enforcement succeed.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:22Overview
- 2:48Example
- 3:43Dynamic Admission Control
- 9:12Implementing a Webhook
- 12:39Webhook Considerations
- 16:30Declarative Access Controls
- 25:20Open Policy Agent Library
- 27:02Questions
related talks
28mEmbracing change: Policy-as-code for Kubernetes with OPA and Gatekeeper
20mDeep Dive: Kubernetes Policy WG
25mCreating and Debugging Kubernetes Admission Webhooks
41mYou Shall Not Pass! Policy Compliance with OPA Gatekeeper
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
27mEmbracing change: Policy-as-code with OPA and Gatekeeper
40mIntro: Open Policy Agent
41mLeveraging WebAssembly to Write Kubernetes Admission Policies