Policy-Based Infrastructure as Code with Kyverno
summary
Kyverno integrates with Crossplane to enforce IaC policies at admission time, claiming to cover code, container, cluster and cloud levels and showing concrete demos: a Kyverno policy rejects non‑compliant Crossplane S3 buckets (creates only us‑west‑2, blocks us‑west‑1; audit mode lets creation but emits a standard policy report), and an image verification rule verifies OCI image signatures (signed images pass, unsigned images are blocked). Project metrics cited: ~3.9k GitHub stars and ~1.6B image pulls.
AI-written summary · about
chapters (12)
- 0:00Policy-based IaC intro
- 1:27What is a policy
- 2:55Infrastructure as code basics
- 5:07Introducing Kyverno
- 7:11Kyverno use cases
- 9:18Policy structure
- 11:55Kyverno’s IaC scope
- 13:19Crossplane overview
- 16:51Enforcing policies with Kyverno
- 17:54Demo: region restrictions
- 20:12Demo: signed images
- 25:19Key takeaways
related talks
49mKubernetes Policy as Code with Kyverno
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
31mKubernetes Native Policy Management with Kyverno!
46mKyverno: Compliance Inside Your Kubernetes Cluster
28mBeyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
31mKnow Your Hard:Automate image security scan with Kyverno & Trivy
27mUnderstanding Kyverno in a Visual Way