Cloud Governance With Infrastructure As Code (IaC) With Kyverno And Crossplane
summary
Crossplane provisions AWS resources via Kubernetes CRDs using plain YAML and kubectl, and the demo actually creates EC2 instances and S3 buckets from those manifests; Kyverno runs as an admission controller and enforces policies that validate, mutate, and generate resources, returning custom denial messages when a request uses a disallowed instance type. Example policies shown: restrict EC2 to t3.medium and require S3 in us-west-1; Kyverno also generates S3 buckets on instance creation.
AI-written summary · about
chapters (15)
- 0:00Cloud governance with IaC
- 1:06What is IaC and benefits
- 4:18IaC security and compliance challenges
- 7:45Crossplane for IaC challenges
- 10:54Setup Crossplane and Kyverno
- 13:08Create infra with Crossplane YAML
- 17:21Enforce policies with Kyverno
- 23:43Summary: Crossplane & Kyverno
- 25:07Q&A: policy violations
- 26:39Kyverno vs Crossplane compositions
- 27:42Group policies with Kyverno
- 28:58Self-service model with Kyverno & Crossplane
- 30:33Kyverno with raw Kubernetes
- 31:38Multiple policy violations in Kyverno
- 33:20Compositions vs Kyverno guidance
related talks
31mThe Crossplane Experience
48mInfra as code, control it from the tower.
49mOperation Crossplane: Cloud Command Tactics
23mUnleashing Potential Across Teams: Infrastructure as Code
18mInfrastructure as Code Security Best Practices & Strats
20mSCS: Large federated infrastructure for sovereignty
40m“So, where do you put IaC of your services?”
34mIaC – Improving and Securing Infrastructure Provisioning in the Cloud