From Policy to Production: Implementing ISO27001/BSI IT-Gr...
summary
Operator runs ~35 Kubernetes clusters and maps BSI/ISO27001 controls to Kyverno. Three implemented controls: generate NetworkPolicy to enforce namespace‑level network separation and auto‑reconcile deletions, policy reports (with a separate report server to avoid ETCD bloat) to audit CIS benchmark settings where node checks are out of scope, and use of cleanup.kyverno.io/ttl labels to trigger regular pod restarts instead of writing a custom operator. Result: 19 of 21 building blocks covered, enforcement creates many tickets but yields cleaner clusters.
AI-written summary · about
chapters (6)
- 0:00ISO27001 and BSI IT-Grundschutz intro
- 1:03Why Kivano matters
- 3:54Network separation with Kyverno
- 9:56CIS benchmark auditing
- 17:49Pod restarts for compliance
- 20:19Summary
related talks
23mFrom Policy to Production: Implementing ISO27001/BSI IT-Grundschutz in Kubernetes with..
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters
49mKubernetes Policy as Code with Kyverno
46mKyverno: Compliance Inside Your Kubernetes Cluster
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
27mUnderstanding Kyverno in a Visual Way
25mShift Left in Action: Automating CIS Compliance With Kyverno and CNCF Power Too...
42mBehold: A New Way to Deploy Pod Security Policies Using Kyverno!