Behold: A New Way to Deploy Pod Security Policies Using Kyverno!
Talkat KubeDay Japan 2022 · on Wednesday, 2022-12-07· at 16:15· Level 3 | InterContinental Ballroom·
summary
Kyverno 1.8.0 implements a dedicated pod security rule that maps PSA profiles (privileged/baseline/restricted) into fine‑grained Kyverno policies, lets operators add per‑control exceptions (fields and capabilities), and uses validate/mutate/generate hooks plus planned image verification. Demo shows policies applied on an EKS cluster, enforced vs audited labels and a blocked privileged pod, and a community library of 237 community policies. Integrates with Kubernetes admission webhooks and namespace labels for PodSecurityAdmission.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:27What is Pod Security admission controller?
- 11:10Architecture of Kyverno
- 12:34Policy to Check for Labels
- 15:41Policy to Restrict Privileged Pods
related talks
37mKyverno Introduction And Overview
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
31mKubernetes Native Policy Management with Kyverno!
49mKubernetes Policy as Code with Kyverno
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
28mBeyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
46mKyverno: Compliance Inside Your Kubernetes Cluster