Policy & GitOps Unite! Kyverno and Flux Save Cluster City
summary
Flux + Kyverno demonstration shows a concrete D2 reference architecture that bootstraps Flux operator from OCI artifacts, signs charts/images with cosign, and enforces image validating policy at admission time using Kyverno’s new CEL-based checks. CI uses Trivy + cosign to publish scans and attestations; policies run in staging audit mode and flip to prod enforce (example: reject images with scans older than seven days). Demo boots a local kind cluster, wires Flux and MCP servers for repo/cluster debugging, and auto-remediations succeed end-to-end.
AI-written summary · about
chapters (15)
- 0:00GitOps evolution
- 2:07Cluster City heroes
- 3:31GitOps challenges
- 5:20Trusted GitOps superpowers
- 7:06D2 reference architecture
- 10:18Deploying Kyverno with Flux
- 13:08Image signature policies
- 15:16Naming conventions audit
- 17:43CVE gremlins defeated
- 20:11Secure supply chain CI
- 21:57AI meets GitOps MCP
- 24:05Flux and Kyverno demo
- 26:11Key lessons
- 27:36Basic policies start
- 28:20Community resources
related talks
42mIntro: Flux
24mHosting Applications in the Real World
39mEnhance Your Kubernetes Experience with GitOps & Flux
07mFluxCD - Gitops For All Sizes
36mManaging Thousands of Clusters and Their Workloads with Flux
27mUnderstanding Kyverno in a Visual Way
49mGitOps, a somewhat realistic scenario on Kubernetes with Flux
06mProject Lightning Talk: Flux - What is it & What's New?