►
Description
Secure by Default with GitOps - A Guide to OPA with Argo CD - Dan Garfield, Codefresh
Argo CD has become the defacto entry for engineering teams to deploy and manage their applications while Open Policy Agent has become one of the most reliable security policy enforcement engines. These two tools work perfectly together and yet there are very few articles and videos on the subject! In this talk, we look at the best strategies for getting these tools to work together to improve the software delivery supply chain. We’ll look at admission hooks, sync waves, and other ways to ensure your applications and clusters are always running in a secure and safe manner. Including example files and reference repos.
Presentation repo: https://github.com/todaywasawesome/osssecure
A
I
think
it's
a
11
30,
so
we'll
get
started,
whoa
whoa
all
right.
Thank
you,
wow,
so
excited
to
speak
to
you
today.
This
is
a
talk
about
Argos
TV,
but
it's
actually
also
a
talk
that
involves
Argo,
workflows
and
so
I
know.
If
some
of
you
are
Argo
workflows,
refugees
who
washed
up
in
this
room,
that's
okay,
you'll
have
something
to
look
at
too
we're
going
to
talk
about
being
secure
by
default
with
get
Ops,
and
this
is
just
kind
of
taking
a
different
approach
to
security.
A
My
name
is
Dan
Garfield
I
am
the
co-founder
and
chief
open
source
officer
of
code
fresh,
raise
your
hand
if
you
know
what
a
chief
open
source
officer
is
and
does
okay
I'll
check
with
you
afterwards
I'd
like
to
find
out,
but
but
yeah
I
work
on
in
code,
fresh
and
I
help
lead
our
open
source
efforts
and
our
contributions
to
the
Argo
project.
I
am
an
Argo
maintainer.
Most
of
the
work
that
I
do
is
it's.
A
Let's
just
say
it's
less
code,
I
don't
do
as
much
code
these
days,
I
do
a
little
bit
here
and
there
I'm,
also
a
founder
and
create
helped
create
the
open,
get
Ops
project
in
the
get
Ops
working
group
which
created
the
get
Ops
principles
which
I
hope
many
of
you
are
familiar
with,
because
we're
going
to
be
applying
those
principles.
Today,
if
you're
not
familiar
with
code
fresh,
we
are
a
a
continuous
delivery,
continuous
deployment
platform
built
on
Argo.
A
We
have
an
Enterprise
version
of
Argo
that
I
would
love
to
hear.
Have
you
check
out
and
hear
what
you
think
about
it?
I
wanted
to
start
really
quick
with
a
brief
story.
When
I
was
a
young
man,
when
I
was
a
kid
I
had
to
skateboard
everywhere,
to
get
places
and
I
started
a
business
building
and
selling
computers
and
fixing
networks
and
doing
networking
for
people
and
on
one
of
my
jobs.
A
Somebody
actually
paid
me
in
an
old
laptop
and
suddenly
I
had
a
laptop
for
the
very
first
time
I
had
portable
Computing
it
had
128
Megs
of
ram
I
threw
netbsd
on
that
thing.
I
stuck
into
my
backpack
and
around
two
or
three
in
the
morning.
I
would
skateboard
out
into
the
neighborhood
I
had
about
40
minutes
of
battery
life.
A
I'd
put
on
my
headphones,
had
to
reinstall
the
audio
driver
for
netpsd,
and
then
I
would
listen
on
war
driver
for
networks
and
then
I
would
find
wdp
networks
and
allegedly,
allegedly
I,
would
try
to
break
into
these
networks
and
and
the
trick
with
WEP.
Is
that
you?
Basically,
if
sponsors
lots
of
clients
going
on,
you
can
send
out
a
signal
that
says
that
they
need
to
re-authenticate
and
then
the
wp
clients
will
all
spray
their
their
keys
back
to
the
server,
and
you
can
get
in
the
middle
of
that
and
intercept
those
keys.
A
And
then
you
can
gain
access
to
the
network.
So
I
tell
you
this
so
that
you
know
that
my
security
credentials
are
very
outdated
and
not
that
useful
for
today
and
second,
because
getting
in
the
middle
is
what
we're
going
to
try
to
stop
from
people
doing
with
Argos
getting
around
Argo
CD.
So
one
of
the
problems
we're
going
to
solve
today.
First,
do
you
know
where
your
software
comes
from?
It's
6
PM.
Do
you
know
where
your
software
comes
from,
and
this
is
a
real
issue
in
the
community?
Is
the
supply
chain?
A
How
do
you
know
that
an
image
or
a
binary
hasn't
been
intercepted?
How
do
you
know
that
a
tag
hasn't
been
overwritten?
You
know,
documentaries
are
supposed
to
be
immutable,
but
when
I
pointed
that
tag,
you
can
switch
the
binary.
That's
behind
that
tag.
So
how
do
I
know
that
what
I'm
getting
is
what
I
want?
How
do
I
know
a
programmer's
machine
wasn't
compromised,
I
know
of
a
company
where
a
programmer
clicked
on
a
phishing
link,
and
suddenly
attackers
started
deploying
to
his
clients
websites,
so
this
stuff
happens.
A
The
second
issue
is:
how
do
you
enforce
rules
on
your
clusters?
You
do
lots
of
trainings,
you
do
lots
of
automation,
maybe
maybe
you
audit
and
you
check
and
make
sure
I
know
another
story
of
a
big
credit
card
company
who
went
to
go
debug
a
service
that
was
failing
and
they
found
out
that
the
team
that
had
been
working
on
it
hadn't
checked
any
code
in
for
the
last
year,
but
they've
been
pushing
what
the
heck
were
they
pushing.
How
did
we?
A
How
do
we
know,
and
then
third
git
office
is
really
great,
so
how
do
we
make
sure
that
people
are
actually
using
it?
It's
very
easy
to
to
get
lazy
and
drop
out
of
the
mode
of
making
git
commits
to
make
all
of
your
changes.
So
how
do
we
make
sure
that
people
are
actually
following
the
process
and
using
the
tools
we
wanted
to
do
when
it
comes
to
security?
Training
is
a
great
first
step.
A
A
We
want
to
enforce
security
policy
and
three
we
want
to
do
it
all
with
Git
Ops
and
to
do
this,
we're
gonna
be
using
Argo
CD
we're
going
to
be
using
the
getoffs
principles,
we're
going
to
be
using
a
project
called
Sig
store,
cosine
and
we're
going
to
be
using
open
policy
agent
as
well
as
kyverno,
so
starting
off
with
Sig
store
cosine.
Many
of
you
how
many
people
are
already
familiar
with
cosine
have
heard
of
this
I'm
a
pretty
good
chunk
of
the
audience.
Probably
most
of
you
have
played
with
it.
A
A
So
the
first
thing:
if
you're
going
to
use
this
basically
the
way
that
cosine
works
is
you
can
sign
images,
Helm,
charts,
other
binaries
and
you
can
sign
it
with
a
key
and
then
you
can
verify
that
key
later,
and
so
you
can
make
sure
that
the
artifact
that
you're
looking
at
was
signed
using
the
key
that
you
expected,
and
this
way
you
can
verify
the
provenance
or
where
an
artifact
came
from.
So
to
do
this
first,
you
need
to
generate
a
key
pair.
A
You
just
run
cosine
generate
key
pair
and
you
can
specify
a
kubernetes
namespace
that
you
want
to
put
that
secret
into.
If
you
want
to
put
it
directly
into
the
cluster
two,
you
can
you,
you
need
to
sign
that
image
and
upload
it
to
the
registry
and
three.
We
can
actually
automate
this
in
a
workflow
template,
so
I'll
just
show
you
really
quickly.
A
We,
if
I,
don't
know
how
many
of
you
are
familiar
with
a
code
fresh
hub
for
Argo,
but
this
is
a
collection
of
workflow
templates
that
are
focused
on
CI,
CD,
devops
and
basically
automating
your
software
delivery
chain,
and
there
is
a
new
one
in
here
called
cosine.
You
can
grab
this
template,
throw
it
in
your
workflow
and
use
it
to
start
deploying
stuff
and
don't
worry,
there'll
be
links
to
all
this
stuff
at
the
end
and
we're
gonna
be
using
that
one
today
as
well.
A
So
the
next
part
of
this
equation
is
going
to
be
Opa.
Now
Opa
stands
for
open
policy
agent.
Many
of
you
are
probably
already
familiar
with
open
policy
agent,
especially
from
its
use
in
service
meshes,
and
it
allows
you
to
create
policies.
General
purpose
policies
like
this
pod
can
talk
to
that
pod
or
this
thing
can't
reach
outside
the
network
or
those
kinds
of
things.
A
So
these
policies
can
do
things
like
protect
namespaces.
They
can
prevent
privileged
containers,
they
can
block
and
allow
image
repos
they
can
limit
replicas.
They
can
do
all
kinds
of
things
and
they
have
a
huge
library
of
these
already
available
called
gatekeeper
library
and
at
the
end
of
this,
I
will
also
show
you
how
to
use
it
to
prevent
people
from
deploying
things
without
using
Argo.
So
if
they
tried
to
apply
things
directly,
we
can
actually
stop
them
from
doing
that,
so
with
Opa
gatekeeper.
Basically,
you
apply
your
manifest.
A
The
admission
web
hook
picks
these
things
up.
It
checks
against
a
constraint
and
then
it
enforces
or
doesn't
enforce
or
allows
things
to
be
deployed
onto
the
scheduler
if
you're
using
this
with
Argo
CD.
The
first
thing
that
you'll
notice
is
that
the
way
that
Opa
gatekeeper
works
is
that
for
each
template
policy
template
it
actually
creates
a
custom
resource
definition.
A
So
for
applying
these
resources,
I
have
a
couple
of
policies
that
I've
already
set
and
I'll
just
show.
You
I've
got
a
policy,
for
example.
That
only
allows
images
from
my
today
was
awesome
repo.
This
is
a
policy
I've
already
set
up
on
my
cluster
and
if
I
were
to
try
to
apply
this-
and
let's
just
do
this
with-
let's
see
samples,
pod
restrict
and
I'm
going
to
send
this
into
my
secure
namespace.
Now
you
can
apply
it
to
all
namespaces
for
the
sake
of
the
demo.
A
A
No,
no
do
not
use
floating
tags
right,
so
we've
detected
that
we've
blocked
it,
and
we've
detected
that
it's
not
from
the
expected
repository,
and
so
you
can
have
you
can
have
these
mixed
and
match
and-
and
you
can
see
how
it
works
now,
with
Argo
CD
today
in
2.4
and
lower
the
way
that
we
actually
validate
resources
is
we
actually
do
a
dry
run
client
now?
What
happens
if
I
do
a
dry
run
client?
Is
it
going
to
pick
it
up?
A
No
there's
nothing
for
it
to
test
against,
because
the
constraints
are
on
the
cluster.
Now
that
means
that
when
we
sync
these
Resources
with
Argo
CD
we're
going
to
have
failures
and
it's
going
to
it's
going
to
flag
them
as
failed.
It's
not
going
to
allow
them
through,
but
it's
going
to
show
up
as
essentially,
if
it's
a
pod,
it
will
show
up
as
just
progressing
it'll,
be
stuck
in
progressing.
A
If
a
specific
resource
failed
to
apply,
then
it
will
flag
that
resource,
but
starting
with
Argo
2.5,
and
we
should
be
able
to
start
cutting
the
release
for
2.5
this
week.
That
doesn't
mean
it's
been
released
this
week,
I
mean
we're
starting
the
branch,
the
release
Branch
this
week.
It
will
actually
do
a
server
side.
A
Dry
runs,
which
means
that
it
will
actually
pick
up
on
and
throw
errors
earlier
and
have
better
support
for
using
injection
web
Hooks,
and
things
like
that
anyway,
all
right,
so
we
just
saw
how
we
can
use
gatekeeper
to
prevent
things
from
getting
deployed.
So
what
about
with
cicd
I'm
going
to
show
you
a
slide
and
it's
going
to
be
really
intimidating,
I'm.
So
sorry
delivering
software
is
complicated.
Sometimes
there's
a
lot
going
on
here,
so
starting
off
with
number
one,
we've
got
our
application
repo.
A
This
is
where
my
application
Engineers
are
working
they're,
making
changes
when
they
cut
a
release.
This
is
going
to
trigger
CI
CD
and,
in
this
case
I'm
using
Code
fresh
as
a
version
of
Argo
workflows.
That
is
hosted
that
I'm
going
to
be
using
because
it's
sort
of
optimized
for
devops
and
it
takes
care
of
my
events
and
stuff
for
me.
So
it's
convenient
we're
going
to
run
our
build.
A
I
said
relatively
quick
here:
the
Wi-Fi
is
a
you
know,
an
issue,
sometimes
all
right.
We
can
see
that
this
is
kicked
off
and
it's
building
and
it's
going
to
build
that
Docker
image
and
as
soon
as
it
does
it's
going
to
kick
off
the
cosine
and
push
it
up
to
my
Docker
registry.
Now,
while
we're
doing
that,
we
can
actually
prepare
the
release.
A
Yes,
it
looks
like
it's
done
baking
that
we
can
see
that
it
signed
the
image
here
and
pushed
the
signature
all
right.
So
once
I've
done,
this
I
can
go
and
kick
off
coin.
New
secure
version
now,
actually
normally
I
would
use
like
Argo
CD
image.
Updater
or
some
other,
maybe
CI,
CD,
to
automate
the
creation
of
the
deploy,
but
everybody
likes
looking
at
pull
requests
being
merged
live,
so
we
just
did
it.
A
Merger
and
pull
request.
Give
yourself
a
high
five
feel
good
about
yourself
and
now
we're
going
to
go
over
and
look
at
our
applications
and
our
demo
accept
app.
Now
we
can
see
this
last
synced
14
hours
ago
and
we'll
trigger
a
refresh,
even
though
it
actually
would
do
it
automatically.
We
would
get
there
wait
for
a
second
and
this
should
trigger
and
kick
off
now
what
am
I
expecting
to
see
it
should
just
work.
So
this
is
actually
not
that
fun
to
look
at.
So
what?
A
If
we
deployed
something
that
wasn't
going
to
work?
How
would
that
look?
So,
let's
do
this
one
again,
except
now,
instead
of
deploying
the
new
secure
version,
I'm
going
to
I'm
going
to
be
deploying
an
out
of
date,
version
right
so
to
do
this,
we'll
go
back
and
edit
our
file
again
and
instead
of
doing
the
secure
version,
I'm
going
to
be
doing
the
Blue
version
go
Blue,
it's
not
secure
fun
and
we'll
we'll
commit
that
one
directly,
because
nobody
laughed
at
my
joke
about
merging
my
own
pull
requests.
A
Okay,
so
we'll
trigger
the
sync
again
really
quick
again,
it
would
pick
up
automatically
and
now
it's
going
to
start
going
and
you
can
see
it's
going
to
be
stuck
in
progressing
because
guess
what
we
can't
deploy
it
because
it
is
denied
because
the
check
image
signature
has
failed,
no
matching
signatures
found,
so
you
saw
that
it
worked
and
then
I
showed
that
I
could
break
it.
Okay,
so
everybody's.
A
Yes,
yes,
smooth
demos,
smooth
demos
are
good,
so
you
can
see
this
actually
fairly
simple
to
implement
and
for
Mirror
developers
perspective
once
you've
implemented
it
it's
basically
in
the
background,
they
don't
even
know
about
it.
It's
just
getting
verified
automatically
and
you
can
apply
this
to
a
lot
of
there's
a
big
push
to
get
more
Community
images
to
be
signed,
so
you
can
verify
their
signatures
and
of
course
you
could
build
them
and
push
them
into
your
own
repo,
and
you
could
push
them
into
your
own
repo
while
verifying
them.
A
You
could
also
make
verification
contingent
upon
Security
checks.
You
could
use
image
scanning
and
all
these
other
things
and
then
say-
and
we
didn't
we're
not
really
going
to
go
into
this,
but
within
cosine
you
can
make
attestations.
So
attestations
would
allow
you
to
say
who
made
it
in
this
case
this
Secret
Lives
on
my
Argo
workflows
instance,
that
is
sitting
on
my
AWS
cluster,
that
I
have
managed
in
code
fresh
and
so
I've
verified
its
Providence.
But
I
can
make
attestations
and
say
this
has
passed
these
kinds
of
security
scans.
A
I
can
verify
that
all
the
commits
were
securely
done
and
that
they
were
all
signed.
So
you
can
do
all
kinds
of
interesting
things.
You
could
actually
take
it
even
farther,
so
we
just
did
it
live.
Oh
yeah
I
was
supposed
to
show
that
slide
before
I
did
it
live
because
it's
a
cool
slide,
all
right,
so
using
Opa
with
Argo
CD.
A
So
this
is
one
of
those
talks
where
I
do
the
demo
in
the
middle
and
I
explain
it
so,
hopefully,
everybody's
feeling,
oh
yeah,
that
made
sense
everything
seems
smooth.
So
how
do
I
actually
make
it
work
within
kubernetes
I.
Think
of
there
are
essentially
two
kinds
of
resources
and
I
made
up
these
terms,
so
you're
not
going
to
Google
this
and
be
like.
Oh,
what
kind
of
resource
is
this,
but
this
is
the
way
I
think
about
it.
A
There
are
fragile
resources,
and
these
are
things
that
are
once
they
are
started
broken
they
will
stay
broken
and
a
good
example
is
an
Ingress
getting
the
wrong
class
because
it's
been
applied
out
of
order.
This
is
something
that
choose
actually
brought
up
to
me
like
a
month
ago.
As
a
common
issue
of
making
sure
these
resources
applied
in
order,
the
other
kind
are
what
I
think
of
as
resilient
resources.
These
are
resources
that,
if
failures
occur,
because
things
are
out
of
order,
they
will
eventually
correct
themselves
and
it'll
be
fine.
A
So
a
good
example
of
this
is
custom
resources.
Custom
resources
will
fail
to
start,
but
once
the
definition
is
found,
they
will
work
so
for
resilient
resources.
For
your
Argo
City
application
policy,
you
can
just
use
a
retry.
You
just
set
a
retry
policy
and
eventually
it'll
work,
I'm,
not
worried
about
it,
failing
to
start
right
away,
it'll
get
there,
but
for
fragile
resources.
You
really
want
to
use
something
some
kind
of
dependency
ordering,
and
so
this
is
where
sync
waves,
sync
Windows.
A
This
is
really
only
an
issue
at
cluster
bootstrap
right,
because
how
often
are
you
going
to
be
applying
a
new
policy
along
with
a
new
service
or
new
resources
that
you
expect
that
policy
to
catch
which
could
potentially
create
a
little
bit
of
a
race
condition
if
we
didn't
apply
them
in
order?
So
bootstrapping
was
a
really
critical
part
of
this,
because
in
order
to
be
get
Ops
compliant,
I
want
to
be
ready
to
bootstrap
and
tear
down
or
restart
all
my
services
at
once.
A
So
we
can
actually
demo
that.
Well,
let's
talk
about
sync
waves
for
a
second.
So
when
you're,
using
Argo
CD
with
gatekeeper
or
another
security
tool
like
kyverno,
you
can
use
retries
on
things
like
policies,
because
they
rely
on
custom
resource
definitions.
You
can
apply
the
policies
before
other
applications,
so
you
can
make
sure
that
you
bootstrap
safe.
A
We
can
also
monitor
application
sync
status,
because
if
we
are,
if,
if
you're
applying
resources
like
a
service,
it
will
fail
to
apply
if
it
violates
policy
and
that'll
show
up
as
a
sync
error,
but
if
you're
applying
it
just
to
a
pod
that
will
show
up
as
progressing
and
it'll
just
be
stuck
in
progressing
forever.
This
also
works
with
multiple
providers,
so
I
haven't
really
touched
on.
A
Kyberna
I'll
bring
that
up
again
in
a
second,
but
this
is
a
competitor
to
Opa
gatekeeper
and
you
can
actually
stack
these
tools
because
they
just
add
hooks
to
your
admission
controllers
and
they
don't
fight
each
other
because
they
basically
work
off,
of
whichever,
whichever
policy
gets
blocked.
That
blocks
the
process,
and
we
don't
have
to
go.
You
know
farther
than
that
with
Opa
gatekeeper,
it
is
possible
to
run
audits,
so
you
can
have
an
audit
report
that
says
hey
these
things
are
actually
exist
that
are
already
on
your
cluster
that
are
violating
security
policy.
A
I
would
prefer
not
to
have
that
happen.
This
is
security
by
default,
not
proactive
security,
because
I'm
really
good
at
paying
attention
to
my
emails
and
then.
Finally,
this
is
going
to
be
a
lot
better
in
Argo
CD
2.5,
because
we'll
actually
do
server
side
apply.
So
the
behavior
for
pods,
failing
policy
versus
other
resources
will
suddenly
become
the
same
they'll
both
show
up
as
synchronization
errors.
A
So
let's
talk
about
sync
waves
for
a
moment
and
how
we
did
this.
Many
of
you
are
probably
familiar
with
sync
waves,
so
I
probably
don't
need
to
go
too
deep
onto
it,
but
if
you're
not
aware
of
it,
there's
a
great
blog
by
Christian
Hernandez
who's
sitting
in
the
front
row
over
here
on
how
to
do
application
dependencies
using
sync
waves.
You
can
use
these.
You
can
mix
and
match
these
with
application
sets.
So
you
use
app
of
apps
with
application
sets
under
as
child
apps.
A
Oh
yeah,
well,
yeah!
Let's
do
the
demo
first,
so
I'll
just
show
you
what
it
looks
like
here:
I'm
using
Argo,
CD
autopilot,
if
you
haven't
used
Argo
CD
autopilot,
it's
an
opinionated,
open
source
implementation
of
Argo
CD
that
basically
bootstraps
your
Argo
CD
instance.
So
it's
self-managing
and
it
creates
a
directory
structure
for
you.
A
A
It
wouldn't
be.
You
could
also-
and
you
could
you
could
make
it
security
only
if
you
wanted
to
be
extra.
You
could
just
say
this
is
the
security
layer.
This
gets
applied
before
anything
else,
that's
in
the
system,
so
you
could.
You
could
go
farther
with
it.
So
to
do.
That
is
pretty
easy.
You
need
to
enable
application
sync
status
to
stop
progression
if
apps
aren't
working.
So
when
app
of
apps
was
first
created
in
sync,
waves
were
created
by
default.
A
The
behavior
was
that,
if
a
if
an
app
was
stuck,
it
wouldn't
move
on
to
the
next
app
and
start
deploying
it.
We
changed
that
in
Argo
1.8,
because
for
many
users
that
was
unexpected,
behavior
and
oftentimes,
you
don't
want
applications
to
necessarily
be
blocking
other
applications.
So
you
can
re-enable
this
Behavior
with
a
config
map
change
which
then
will
monitor
if
an
application
is
progressing,
and
it
will
count
that
as
part
of
the
sync
status
that
needs
to
happen
as
a
prerequisite
to
the
next
step
in
the
process.
A
If
you're
using
this
with
all
the
Argo
CD
autopilot
you'll
need
to
use
a
customization,
it's
the
same
code,
it's
just
in
a
customization
in
case
you,
you
know,
haven't
seen
how
to
how
to
merge
that
and
then
you
just
set
a
sync
wave
and
you
can
set
a
sync
wave
one
on
your
system
requirements
in
a
sync
Wave
2
on
the
user
space.
Now
remember.
This
only
applies
to
the
parent
applications.
A
So
if
you
have,
within
the
user
space
a
whole
bunch
of
applications
defined
that
have
a
sync
wave
minus
one
in
normal
operation,
those
will
get
deployed
before
the
applications
under
system
requirements.
So
the
use
case
that
I
was
really
talking
about
here
is
bootstrapping.
That's
why
it's
useful
that
race
condition
that
could
happen
if
you're
trying
to
apply
a
policy
and
an
application
change.
At
the
same
time,
it's
like
a
it's
like
a
bizarre
scenario
that,
like
I,
can't
imagine
happening
and
you'd
probably
have
to
take
some
extra
steps
to
mitigate
that.
A
If
you
think
that's
an
issue,
but
it's
like
it
would
require
an
attacker
to
be
pushing
a
change
and
adding
a
policy
to
restrict
itself
at
the
same
time.
So
why
would
anyone
ever
do
that?
It's
like
counter
to
your
incentives,
so
I,
don't
think
it
would
be
an
issue
but,
like
I
said,
I'm,
just
a
kid
on
a
skateboard.
So
if,
if
that,
if
you
think
that's
a
bad
policy,
let
me
know
okay.
So
next
there
we
go.
The
next
thing
is
to
prevent
applying
resources
without
Argo
CD.
A
A
So
what
if
first
of
all
can
I
apply
if
I
apply
manifest
directly
to
the
cluster
without
Argo
CD
will
Opa
gatekeeper,
not
function,
no
it'll
function
right,
okay,
gatekeeper
will
still
apply
policies,
but
what,
if
I'm
just
trying
to
deploy
stuff-
and
in
this
case
it's
our-
is
my
team
actually
using
gitups
what
resources
are
being
deployed
that
aren't
tracked
with
within
Argo
CD?
So
to
do
this,
we
can
create
a
simple
policy,
and
this
is
what
that
policy
looks
like.
A
If
you
can
see
it
here,
I
have
an
enforcement
action
deny
this
relies
on
a
a
live
gatekeeper.
Library
can
so
many
were
so
many
buzzwords
all
at
once.
It's
hard
to
get
out.
Gatekeepers
library
has
a
has
a
constrained
template
called
KH
required
annotations.
So
to
use
this,
we
need
to
make
sure
that
Argo
CD
is
tracking
with
annotations,
and
then
we
can
just
set
our
policy
in
this
case,
I'm
restricting
services
and
pods
in
the
secure,
namespace
and
I.
Actually
don't
have
that
enabled
right
now.
A
Merge
conflicts
are
fine.
Nobody
Minds
I,
already
push
that.
Okay,
so
now
that
I'm
pushing
this
policy
again,
all
these
policies
are
managed
in
Argo
CD.
You
probably
don't
care
that
much
about
seeing
constraints
managed
in
here,
but
you
can
see
it
just
deployed.
So
you
can
see
each
of
these
shows
up
as
a
resource
in
here.
Just
like
you
would
expect
it
to
so
now.
If
I
try
to
apply.
A
A
Now,
as
you
can
see,
it's
forbidden,
you
must
provide
annotations.
Basically,
it's
looking
for
annotation
IDs
from
that
Argo
CD
sets
to
make
sure
that
those
are
set,
so
otherwise
you
can't
deploy
it.
If
I
were
to
apply
this
outside
of
my
secure
namespace,
let's
say
the
default
namespace,
then
it
should
work
just
fine,
because
I
scoped,
my
permissions
to
yeah,
see
it
works
just
fine,
because
I
scoped
it
to
only
that
namespace.
So
all
right
so
last
thing
bonus
tip
if
you
are
using
kyverno
and
you're.
Probably
thinking.
A
Why
is
he
talking
about
Carbono
Carbono
is
the
competitor
to
Opa
gatekeeper,
they're,
both
cncf
projects
they're,
both
great
projects,
I
recommend
checking
them
both
out.
If
you
are
using
kyverno,
it
mutates
resources
and
adds
a
lot
of
information,
and
so
you
will
need
to
add
that
to
your
application,
checking
to
make
sure
that
you're
instead
of
creating
crds
it
creates
these
mutations.
So
you
just
need
to
remove
those
there's
a
link
on
how
to
remove
that.
So
what
do
we
accomplish?
We
verified
our
software
supply
chain.
A
We
verified
that
located
with
the
skateboard
is
going
to
come,
get
into
the
middle
of
my
supply
chain
and
deploy
something
I
don't
want
deployed.
We
enforced
a
security
policy
and
made
sure
that
people
couldn't
deploy
stuff
that
wasn't
signed
and
we
did
it
with
a
hundred
percent
get
offs.
We
made
sure
that
people
are
using
our
Argo
CD
they're,
not
trying
to
bypass
the
process
for
how
we
deliver
process
software,
we're
able
to
verify
all
these
things
and
ensure
it.
A
So,
even
if
I
have
failures
down
Upstream
like
somebody
getting
access
keys,
they
shouldn't
have
or
somebody
somebody
having
permissions
that
are
looser
than
they're
supposed
to
be
or
any
of
those
kinds
of
things
we
still
can
enforce
and
make
sure
that
this
stuff
happens
and
when
it
works,
it's
transparent
to
the
developer
experience.
They
don't
notice
it
because
they're
not
violating
the
policies
and
if
they
are
violating
the
policies,
it
then
means
they
didn't
follow
the
training.
But
remember
training
was
just
the
first
step,
not
the
last
one.
A
So
with
that,
there's
a
link
bunch
of
links
in
here
again.
This
is
all
in
the
git
repo
I'll.
Give
you
a
second
to
take
a
picture
and
then
I
want
to
give
a
shout
out
if
you
haven't
already
registered
for
it
or
if
you
haven't
already
done
it,
the
we
have
amazing
get
op
certification.
That
is
the
number
one
in
the
world.
We
have
over
10
000
students,
it's
probably
over
11
000.
A
A
A
A
That's
a
very
sharp
observation:
is
it
not
trivial
to
add
The
annotation
that
it's
expecting
it
is
fairly
trivial
to
add
The
annotation
that
it's
expecting
in
this
case
this
works
as
a
pretty
soft
rule
enforcement
to
say,
like
so
I
imagine
a
scenario
where
maybe
your
hair
is
on
fire
everything's
exploding
around
you
and
you
want
to
go
interact
directly
with
the
cluster
and
you've
broken
all
the
glass
and
you've
gotten
permission
to
do
it.
You
can
work
your
way
around
it.
A
That
is
not
a
security
enforcement
measurement
when
it
comes
to
making
sure
that
resources
are
applied
with
kubernetes
with
Argo
CD.
In
that
case,
it's
really
about
making
sure
that
people
are
following
the
training
and
the
policy
of
how
things
should
be
deployed.
If
they
want
to
get
around
it,
they
could,
but
you
would
be
able
to
also
audit
it
and
follow
up
later
and
say
hey.
Why
are
you
always
doing
this,
so
it
wouldn't
be
in
the
dark
at
least
yeah.
B
A
So
you
can,
you
can
enforce
gatekeeper,
Works
off
of
injection
web
Hooks,
and
so
there
are
lots
of
policies
that
are
designed
around
making
sure
that
resources
don't
get
onto
your
cluster.
It
also
has
policies
around
pods
and
how
they
function.
So,
for
example,
you
can
have
a
pot,
you
can
have
a
policy
that
says
Don't
deploy
any
pods
that
that
allow
privileged
access
and
that
kind
of
thing.