1 of 33

Kyverno �

Kubernetes Native Policy Management

�

1

July, 2023

Luxembourg

2 of 33

Agenda

  • Why Policies?
  • Why Kyverno?
  • Top use cases
  • How Kyverno policies work
  • Demo
  • Summary
  • Q&A

2

3 of 33

About us

3

  • Intern at Nirmata
  • Kyverno Contributor

​

​

​

  • Staff Engineer at Nirmata
  • Kyverno Co-creator and Maintainer

​

Shuting Zhao

Vishal Choudhary​​

4 of 33

Why policies?

5 of 33

The rise of Kubernetes platforms

5

96% of enterprises are using or evaluating Kubernetes – CNCF survey

6 of 33

The cost of missing Kubernetes guardrails

Confidential

6

Phase

Pre-deploy

Production

Cost per defect

$25

$15,903

Cost per cluster

$8151

$5,216,193

https://www.cncf.io/blog/2022/02/02/the-cost-of-a-kubernetes-repair-in-development-vs-production/

average # of misconfigurations per cluster

328

average # of workloads per cluster

110

average # of findings per workload

3

7 of 33

7

Policies are a contract

Developers

Security

Operations

​

8 of 33

What policies provide

  1. Separation of concerns across Dev-Sec-Ops roles
  2. Security via validation and enforcement checks
  3. Just-in-time automation

​

8

9 of 33

Why Kyverno?

10 of 33

Kyverno is the Kubernetes native policy engine

10

  • 1.3 Billion+ image pulls
  • 3.6K+ GitHub Stars
  • 300+ contributors
  • 1700+ Slack members
  • 230+ policies

PAGE 10

CNCF project created and maintained by Nirmata

  • Eliminate misconfigurations
  • Prevent vs. detect
  • Shift-left security

11 of 33

Why Kyverno?

  1. Make K8s policies easy to write and manage
  2. Make policy results easy to process
  3. Validate (audit or enforce), Mutate, and Generate
  4. Support all Kubernetes types including Custom Resources
  5. Use Kubernetes patterns and practices �e.g. labels and selectors, annotations, events, ownerReferences, pod controllers, etc.

11

Kyverno simplifies K8s policy management!

12 of 33

CNCF Policy Engines: Kyverno or OPA?

Confidential

12

Kyverno

OPA / Gatekeeper

Kubernetes-native

General purpose rules engine

Policies are declarative Kubernetes resources

Custom DSL (Rego) built for authorization

Validation

Validation

Mutation

--

Generation

--

Image Verification

--

Native CNCF standardized reporting

--

Use GitOps and other Kubernetes tools

--

Higher performance with lower resources

--

“Thank you all for Kyverno, It made K8s policy really easy, I struggled for months with OPA/Gatekeeper, I am glad I found Kyverno.” – GKE admin on community forums

13 of 33

Kubernetes Policy Management Tools Compared �OPA with Gatekeeper vs. Kyverno -- by Viktor Farcic

�

14 of 33

Top Use Cases

15 of 33

Kyverno Policy Management Use Cases

15

SecOps

DevOps

FinOps

  • Pod security
  • Workload security
  • Granular RBAC
  • Workload isolation
  • Image signing & verification
  • Workload identity
  • Self-service Kubernetes environments
  • Self-service infrastructure (IaC)
  • Resource governance and cleanup
  • Label/Annotation management
  • Naming conventions
  • Event driven automation
  • Custom CA management
  • Time-bound policies
  • Quota Management
  • Pod Requests and limits
  • Team and app labels
  • Scaling limits
  • Scheduled resources
  • QoS management
  • Auto-scalers

Admission Control & Background Scans

Command Line Checks

In-cluster

CI/CD pipelines

Top Use Cases

16 of 33

How Kyverno Policies Work

17 of 33

Kyverno Architecture

17

  • Admission Controls
  • Command Line (CLI)
  • Runtime scans

18 of 33

A Kyverno Policy

18

19 of 33

A Kyverno Policy

19

apiVersion: kyverno.io/v1

kind: ClusterPolicy

metadata:

name: require-labels

spec:

validationFailureAction: Enforce

background: true

rules:

- name: require-team

match:

any:

- resources:

kinds:

- Pod

validate:

message: 'The label `team` is required.'

pattern:

metadata:

labels:

team: '?*'

​

20 of 33

Validate Policy

  • Overlays with patterns specify desired state
  • Matches all defined fields
  • Patterns
    • * : zero or more
    • ? : any one
  • Operators
    • >, <, >=, <=, !, |(or)

20

21 of 33

Mutate Policy

  • JSON Patch (RFC 6902)
    • Use for precise updates
  • StrategicMergePatch
    • Use for describing intent
    • Anchors for conditional logic
      • “If-then-else”
      • “if-not-defined”

21

22 of 33

Generate Policy

22

  • Triggers when a new resource is created or based on label and metadata changes
  • Useful in creating defaults for a namespace
  • Clones existing resources or copies in-line data
  • Can optionally keep data in-sync across namespaces

23 of 33

Image Verification Policy

  • Native Sigstore support!
  • Support for Notary!
  • Match images using wildcards
  • Verify multiple signatures
  • Optional signature registry

​

23

24 of 33

Cleanup policies

  • Delete resources based on flexible match/exclude and conditions
  • Run checks periodically using Cron schedule format

​

25 of 33

Demos

26 of 33

�Additional Features

27 of 33

Additional Features

  • Built-in and Custom Variables
  • JMESPath Support
  • API Lookups
  • Cached ConfigMaps
  • OCI Registry integrations
  • OpenTelemetry Metrics and Spans
  • Policy Reporter (In-cluster dashboard)
  • YAML Signing
  • Policy Exceptions

​

27

28 of 33

Summary

29 of 33

Key Takeaways

  1. Policy is a must have for Kubernetes security and compliance
  2. Kyverno is a CNCF policy engine built for Kubernetes
  3. Kyverno is easy to get started and try out!

29

30 of 33

Join the Kyverno Community

  • The Kyverno docs & samples: https://kyverno.io
  • Slack Channel: https://slack.k8s.io/#kyverno
  • Monthly office hours for Kyverno
  • Weekly contributor meetings

​

30

31 of 33

Get Kyverno Certified!

  • Free training and certification

https://learn.nirmata.com

32 of 33

Thanks!

https://kyverno.io

33 of 33

Q & A

https://kyverno.io