Shift Left in Action: Automating CIS Compliance With Kyverno and CNCF Power Too...
summary
Shows a working CNCF-native CIS automation: Kyverno as policy orchestrator, OpenTofu plan -> JSON scanning, and kube-bench plus a daemonset node scanner for node checks. Demonstrates CEL-based ValidatingPolicies that run at plan and admission time, enforces 64 CIS checks across EKS, AKS, and GKE, and wires everything into a GitHub Actions pipeline. Live demo spins up a cluster and reaches ~99% automated validation in under 15 minutes, with clear reject messages on failed admissions.
AI-written summary · about
chapters (10)
- 0:00Introduction and problems
- 2:08Shift-left architecture
- 4:17Validation stages explained
- 6:25Kyverno policy engine
- 8:39Policy breakdown
- 10:15Repository structure
- 12:56Deployment-time demo
- 16:58Plan-time validation demo
- 20:24Runtime and CI/CD results
- 22:32Q&A and concluding remarks
related talks
35mShift-Left Policy Validation in Kubernetes With Kyvern...
23mFrom Policy to Production: Implementing ISO27001/BSI IT-Gr...
32mCloud Native Policy as Code: Principles and Best Practices
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
25mNetwork Policy Nirvana: Automating Security & Self-Service...
37mKyverno Introduction And Overview
41mAvoiding IAC Potholes with Policy + Cloud Controllers
46mKyverno: Compliance Inside Your Kubernetes Cluster