►
Description
KCD Italy 2021* - The video of the talks are now available!
Mettere in sicurezza un cluster Kubernetes richiede l'uso di diverse strategie e di strumenti per attuarle. Tra queste, i Dynamic Admission Controllers giocano un ruolo fondamentale per garantire non solo la sicurezza di un cluster, ma anche la sua compliance. Infatti tramite di essi è possibile definire, ed applicare, regole personalizzate.
Nonostante molte organizzazioni riconoscano l'importanza di abbracciare la "filosofia" Policy As Code, sono purtroppo poche le realtà in cui questa metodologia viene utilizzata in ambienti di produzione. Durante questo talk mostrerò come WebAssembly, una tecnologia nata originariamente per il Web, possa essere utilizzato per implementare strategie di Policy As Code in Kubernetes.
Vedremo come l'adozione di WebAssembly semplifichi il processo di creazione, mantenimento e distribuzione di queste policy.
🤓 SPEAKER: Flavio Castelli, Distinguished Engineer @ SUSE
👉🏼 Here the slide deck: https://www.slideshare.net/KCDItaly/kubernetes-policy-as-code-usando-webassembly-flavio-castelli
______________________
* KCD Italy 2021 is the first edition of a community-organized non-profit event that will take place on November 17th and 18th and will gather adopters and technologists from open source and cloud native communities for education, collaboration, and networking.
📯 Follow us to be notified about the upcoming MeetUps: https://community.cncf.io/kubernetes-cloud-native-milano/
A
B
So
I
advise
you
to
go
and
read
it,
because
it
is
very,
very
nice
and
then
another
good
news,
and
that
is
that
yesterday,
for
those
who
followed
yesterday,
they
will
have
seen
that
our
ethical
binary
sponsor
has
made
10
places
available
for
a
course,
and
there
are
still
two
so
also
look
at
the
chat
in
this
case,
because
the
link
is
about
to
turn
where
you
can
book
your
place
and
I
remind
you
of
the
pizza
with
the
ass.
No.
So
having
said
that,
let's
move
on
I
invite
on
stage
fabrizio
pallini
of
vmware.
C
B
C
Certainly
then,
also
in
this
case,
the
community
surprised
us,
it
is
the
first
time
we
did
neither
hedges
and
we
received
60
responses.
So
we
could
do
six
days
of
tle
were
all
of
exceptional
quality,
and
the
spectacular
thing
was
that
we
received
talks
not
only
from
all
over
Italy
from
Bolzano
to
the
islands,
but
we
received
talks
from
all
over
the
world.
There
was
the
United
States,
there
was
France
Spain
Spain,
we
saw
Germany
England,
there
was
china,
there
was
asia
and
there
was
also
austria.
C
We
made
a
committee
of
77
experts
practically
one
for
each
organizing
company
and
in
the
end
we
did
something
with
me:
460
review
cards
and
several
rounds
of
voting
to
arrive
at
selecting
the
ten.
It
was
very
difficult
to
choose
the
10.
It
was
really
a
challenge.
The
good
news
is
that
those
who
didn't
make
it
which
didn't
make
it
they
did
it.
We
asked
if
they
wanted
to
present
their
talk
at
the
meetup
that
we
hold
every
month
and
therefore
you
will
have
the
opportunity
to
see
some
of
these
talks.
B
I
would
say
that
the
meetups
will
also
start
again
soon
and
we
will
be
able
host.
Also
many
speakers
also
say
international,
wonderful
that
they
participated
from
all
over
the
world
and,
yes,
we
told
about
the
knicks
are
local
events
but
open
to
everyone.
So
it
is
really
nice
to
see
both
the
local
cases
requested
the
contamination
from
all
over
the
world
fabrizio
yesterday
psi
you
have
already
been
introduced,
but
not
everyone
was
there
yesterday.
So
I
would
ask
you
to
tell
a
little
who
you
are
and
then
introduce
the
next
speaker.
Of
course,.
C
Thanks
then,
I'm
fabrizio
pallini
I
work
at
one,
where
he's
also
a
little
bernax
contributor.
If
you
want
to
meet
me,
you
can
find
me
in
acronym
starei
cycle
follows
projects
like
cuba
in
cluster
and
pia
and
etcetera
etcetera.
But
today,
I'm
not
here
to
talk
about
juan
werne,
to
talk
about
what
I
do
and
upstream
to
to
introduce
our
speakers.
C
Next
speaker,
flavio
castelli,
who
distinguished
engineers,
suse
and
fabio
work
on
linux,
sui
with
tenacity,
fabio
salvo,
nt,
loves
to
explore
new
technologies
and
contribute
to
open
source
projects,
and
I
share
his
work
and
no,
regardless
with
everyone.
He
is
someone
who
loves
the
community
like
us,
so
space
for
diego.
Thank
you
very
much.
D
The
honor
to
be
here
thanks
for
the
opportunity,
as
mentioned
before,
I
am
fabio
castelli,
I
work
and
suse
I
am
within
the
ranger
division.
I
am
here
today
to
talk
to
you
about
how
an
emerging
technology
such
as
web
assemblies
can
be
used
to
simplify
the
process
of
creating,,
maintaining
and
distributing
policies
for
which
Unitis
talking
about
policy
for
gubernatis.
The
central
issue
is
that
of
security.
D
I
would
like
to
start
by
showing
you
the
results
of
a
survey
recently
done
by
vmware,
in
which
they
went
to
explore
different
issues
of
the
kuber
nitish
world
and
as
regards
the
issue
of
security,
then
going
into
the
specific
points.
Key,
the
main
concerns
were
varied,
but
the
first
place
there
is
the
fact
of
going
to
apply
policies
in
a
uniform
way
to
those
that
are
all
classic
berny.
D
You
come
out
organization
you
find
yourself
having
to
manage,
and
also
within
the
same
of
the
same
cluster
gubernatis
go
apply
the
policies
in
this
uniform
way,
even
between
the
namespaces
that
are
assigned
to
different
projects,
different
teams,
anything
else.
The
purpose
of
having
these
policies
is
not
strictly
related
to
security.
D
Therefore,
preventing
any
cyber
attacks
or
abuses,
but
it
is
also
a
very
important
concept
within
compliance
strategies
in
the
cluster.
Therefore,
in
my
opinion,
the
only
way
to
go
about
solving
problems
effectively
is
to
go
and
fully
embrace
what
the
policy
code
philosophy
is
and
how
we
are
going
to
use
a
declarative
approach
to
what
the
definition
of
our
workloads
we
think
is
gubernatis
or
even
the
definition
of
the
very
infrastructures
of
our
clusters,
so
I
think
on
the
ground
cloud
formation
or
anything
else.
D
The
same
approach
can
also
be
used
to
go
and
solve
this
problem
of
policies.
In
fact,
coburn
itis
already
offers
several
ideas
to
go
about
solving
this
problem
in
various
areas.
I
am
thinking
of
the
roll
bisex
control
policies.
I
am
thinking
of
the
puddles
of
cures
and
policies
that
are
now
being
applied,
but
will
be
replaced
by
another
tool
based
again
on
poles
heats
up
in
networking
policies
and,
finally,
the
admission
controllers
for
those
who
had
the
opportunity
to
see
yesterday,
there
was
a
really
very
interesting
talk
by
nicolò.
D
Congratulations
nicolò,
who
talked
about
smooth
openpolis,
jesi
controller
I
will
talk
about
it
too.
Here
today,
we
will
go
again
to
talk
about
this
topic,
but
with
a
different
perspective
for
those
who
missed
yesterday's
talk,
a
brief
summary
of
what
admission
controllers
are:
what
mission
controllers
do?
They
are
elements
it
works
like
this.
They
receive
a
jason
object
as
input
that
describes
an
operation
that
is
about
to
take
place
at
internal
to
the
cluster
and
therefore
this
could
be
the
creation
of
a
bit
of
an
update
of
an
entrance
to
the
deletion
of
a
service.
D
These
are
requests
that
have
already
been
authenticated
and
authorized.
However,
the
admission
controllers,
using
some
ground
logic,
are
going
to
decide
which
what
to
do
with
these
requests
and
possible.
The
possible
responses
are
one
to
accept
the
request
and
then,
let's
say
the
ball
passes
to
to
the
next
mission
controller.
Yes,
it
exists
at
the
end
of
the
whole
chain,
then
the
object
is
created
in
inside
sd
and
consequently,
the
whole
gubernatis
reconciliation
cycle
starts
or
the
request
can
be
blocked
immediately.
So
the
user
will
never
see
this
operation
take
place.
D
He
will
receive
an
error
from
the
servers
explaining
the
reason
or
I
have
some
myths.
Shaun
admission
controllers,
which
can
accept
a
request
but
change
how
the
object
will
actually
be
created.
A
practical
example
suppose
we
want
to
set
resource
limits
to
all
posts
that
exist
in
our
cluster.
We
can
have
a
dynamic
admission
control,
sorry,
a
mission
controller
of
type
mutation
that,
when
the
user
logs
on
he
forgets
to
specify
the
limits
he
puts
them
in
its
place,
abusing
the
default
values
and
set
by
the
cluster
administrator.
D
So
they
are
all
very,
very
concrete
cases
now
coburn
itis,
a
series
of
nation
controllers
inside
which,
however,
are
unable
to
satisfy
what
are
the
various
required
needs
of
those
who
use
gubernatis
and
therefore,
via
the
concept
of
dynamic
admission
controllers,
which
are
basically
controllers
that
work
exactly
with
this
logic,
but
are
outside
the
official
binaries
of
cuper
nitish,
so
to
speak,.
This
is
the
mechanism
with
where
everyone
can
go,
extend,
add
policies
for
coburn
itis.
D
D
Then
we
know
whose
caverns
yesterday
already
exist
and
are
looking
for
already
existed
before
we
began
to
address
the
problem
and
we
thought
there
was
a
better
strategy
to
simplify
and
promote
the
adoption
of
the
policies
code
within
organizations.
For
this
reason,
we
created
an
open
source
project
called
chi
worden,
which
has
a
kuber
netease
policy
engine,
but
it
works
in
a
slightly
different
way.
We
set
ourselves
a
series
of
goal
blasts
when
we
started
considering
creating
a
new
new
project
in
this
space.
D
If
the
team
is
not
on
add
or
aware
of,
for
example,
rust,
the
thing
could
be
analogous
then
write
some
code
in
rast,
which
goes
to
carry
out
in
this
case
a
check
on
those
that
are
the
security
context
of
a
container
or
why
not?
If
the
team
is
familiar
with
swift,
you
can
go
and
write
a
policy.
In
my
opinion,
it
should
be
possible
to
go
and
write
a
policy
which,,
as
in
this
case,,
goes
to
check
the
run
time
class
of
a
pod
and
even
goes
to
mutate
it
to
allow
a
different
run.
D
Ton
class,
for
example,
going
to
force
the
use
of
dg
visor
of
kata
containers
if
the
non-
canon
workload
does
not
belong
to
a
user.
Maybe
we
trust
here
is
the
fact
of
having
the
possibility
of
using
traditional
programming
languages
allows
time
itself
of
going
to
draw
from
the
gigantic
ecosystem
basin
of
these
languages.
,
therefore,
going
to
use
libraries
already
present,
and
also
from
the
point
of
view
of
the
policy
framework
of
going
to
provide
the
est
decay
to
go
and
simplify
the
work
of
these
of
these
developers,
and
so,
for
example.
D
This
is
an
example
of
a
script
and
rast
policy,
where
the
line,
in
my
opinion
is
essential.
This
one
where
we
are
going
to
do
a
mild
shawn,
and
you
should
know
it
was
already
briefly
mentioned
yesterday-
that
the
format
that
cooper
niti
expects
to
receive
a
response
from
a
mission
controller
who
carries
out
a
year
of
mutation
for
himself
is
a
bit
particular,
and
we
do
not
think
it
is
right
that
creating
this
request,
format
becomes
an
obligation,
in
short,
becomes
a
concern
of
whoever
goes
to
write
it
policy.
D
So,
as
is
expected
in
any
program
we
go
to
write
daily,
there
are
libraries
that
go
and
simplify
this
operation,
so
in
this
case
our
work
is
to
go
and
provide
honest
that
it
is
rich
that
allows
to
minimize
the
worries
of
those
who
go
to
write
these
these
policies.
The
same
then
applies
even
in
the
context
of
going
to
configure
the
policies,.
D
This
enforcement
policy
goes
in
series
of
parameters
that
are
in
conflict
with
each
other,
for
example,
it
could
say,
with
all
apple,
is
both
prohibited
and
required
so
to
prevent
this
kind
of
scenarios,
what
we
go,
what
is
provided
is
a
mechanism
for
having
impacts
validation
of
the
policy
settings.
Here
too,
an
example
written
in
rubber.
Obviously,
everyone
is
free
to
use,
let's
say
the
language
they
deem
most
appropriate
having
some
common
code
in
writing
the
policies.
D
We
can
therefore
also
continue
to
use
a
whole
range
of
best
practices
and
policies
with
regards
to
writing
code,
not
only
for
what
is
the
process
of
creating
our
code,
the
application,
but
also
the
creations
of
the
policies
themselves,
and
therefore
this
translates
into,
for
example,
having
a
process
of
to
code.
God
of
policies,
a
code
review
process
in
which
many
people
within
our
organization
can
participate,
as
the
policies
are
written
with
languages
that
everyone
knows,
and
therefore
everyone
is
able
to
understand
what
the
poli
are
doing
and
this.
D
In
my
opinion,
it
is
extremely
important
because
we
ended
up
talking
to
several
people
faced
with
situations
where
there
were
only
a
select
few
experts
who
could
understand
what
the
policies
did
and
these
people
were
therefore
saddled
with
a
lot
of
work
and
beyond
not
being
happy
with
it
all.
They
really
represented
a
bottleneck
even
within
the
organization.
Instead,
the
fact
of
having
the
possibility
of
using
common
programming
languages
allows
us
to
carry
out
the
procedures
that
we
do
every
day
with
ours.
D
When
we
write
our
applications,
the
traditional
continuous
saying
I
mean
precisely
those
that
our
end
users
use
not
the
policies.
So
in
this
case,
for
example,
very
interesting,
it
is
a
polis
registered
in
the
ras
and
therefore,
at
the
end
of
the
execution
of
a
the
sweet.
We
are
going
to
use
the
inter,
then
transform
lippi
for
ensure
that
the
code
of
the
poli
maintains
an
adequate
level
of
quality,
and
since
policies
are
so
critical
and
important
that
our
policies
are
tested,
they
have
code
of
a
quality
that
we
can
feel
proud
and
confident.
Of.
D
One
last
note
on
testing
the
testing
of
the
policies
being
written
in
regular
programming.
Languages
can
be
done
using
what
are
the
texts
in
the
framework
of
the
language
that
we
have
used
and
even
in
the
case,
I
give
an
example.
I
am
writing
a
ngo
policy
and
within
ours
our
team
does
not.
We
like
the
official
vigo
testing
framework,
but
instead
we
prefer
to
use
ginko
to
name
a
name.
D
Can
I
use
ginko
also
to
test
what
the
code
of
my
policies
last
last
note
goes
hand
in
hand
that
the
integration
of
policies
within
pipe
line
of
continuous
integration
and
continuous
of
free
is
completely
transparent.
It's
like
when
you
go
to
make
a
release
of
one
of
a
regular
application.
So
here
we
have
a
pipeline
of
tav
action
which
could
be
that
of
our
web
application
of
turn
so
battery
of
each
text,
batteries
of
wind
in
test
and
then
release
of
the
various
artifacts.
D
Now
you're
wondering
how
we
carried
out
how
we
implemented
it
all.
Let's
say
that
the
title
of
the
presentation-
a
crazy
sprinkling,
so
you
already
know
it
we
depend
seriously
really
happily
in
the
sense
we
feel
heavily
very
su
ad
assemblies
and
for
those
unfamiliar
with
web
assembling.
It
always
had
a
banner
instruction
format
that
works
like
this.
D
We
have
programming
languages,
on
the
left
and
then
through
compilers
of
these
programming
languages,
we
get
websense
file,
dot
one
file,
so
instead
of
compiling
the
our
program
and
get,
for
example,
a
binary
for
linux
intel
architecture,
I
keep
this
file
web
assemble
this
file.
Web
assembly
has
some
features.
D
First
of
all,
it
is
very
small,
so
going,
for
example,
take
the
case
of
naples
policy
written
in
throat
weighing
300k
on
air
ascom
league
and
a
half
I
have
neither
swift
on
10
mega,
which
is
a
lot
10
mega
and
shamefully
for
the
web
assembly
world,
which
is
a
bit
ridiculous
going
to
buy.
What
are
the
dimensions
of
our
images
to
contain?
But
here
is
the
small
dimension
and
it
depends,
above
all,
on
the
degree
of
maturity
of
the
compiler.
D
In
the
case
of
swift,
there
is
still
some
work
to
do,
but
here
they
are
extremely
small,
therefore
easy
to
move.
Also,
the
absolutely
important
thing
shocking.
The
fact
that
they
are
portable
web
assembly
was
born
as
a
mechanism
to
roll
out
browsers
initially,
so
it
needs
a
runtime
within
which
to
run,
and
for
many
years
the
runtime
was
the
browser.
D
But
in
recent
years
there
has
been
an
explosion
to
have
use
of
white
web
sun
outside
the
browser,
because
the
advantages
it
brings
are
considerable
and
it
is
what
we
are
actually
doing
with
who
we
board
with.
We
support
web
sandri,
runtime
external
to
the
browser,
and
then
we
take
a
web
assembly
module
and
then
once
we
put
it
inside
a
runtime,
the
shocking
thing
that
we
absolutely
don't
care
to
know
what
it
is
underlying
operating
system
and
what
is
the
underlying
architecture?
D
This
translated
in
a
nutshell
means
that
I
as
a
developer
can
compile
my
application
on
my
apple
laptop
with
arm
architecture
and
then
obtain
a
web
assembly
module
the
same
web
assembly
module
then
at
runtime
can
run
in
my
cluster
gubernatis,
which
uses
linux
as
intel
architecture,
so
o
demobile,
really
big
ones,
is
not
freeware.
Last
note
regarding
web
assemblies
is
fact
that
it
was
initially
conceived
for
use
inside
the
browser.
It
meant
that
a
lot
of
attention
was
paid
on
what
the
issue
of
web
security
assembles.
D
D
The
same
thing
in
our
opinion,
to
do
also
at
the
operation
level,
so
the
first
key
point:
how
to
go
to
distribute
the
policies,
the
policies
these
web
files
look
like
they
can
come,
we
go
to
distribute
using
a
mechanism
they
allow
to
contain
registry
and
therefore,
if
we
find
ourselves
a
situation,
a
scenario
in
which,
in
the
same
count
in
the
registers,
we
know
the
workloads
to
contain
images
that
we
must
go
to
release
our
clusters.
We
also
have
policies
to
secure
these
clusters.
These
applications
security.
D
It
follows
that
everything
we
already
have
in
place
as
practical
tools
for,
for
example,
distributing
across
different
geographies.
Our
containing
images
also
applies
the
same
way
for
policies
all
that
is
in
place
to
secure
access
is
contain.
Registries
to
images
and
the
continuous
registries
apply
in
the
exact
same
way
to
policies
as
well,
so
no
new
tools
to
create
on
a
particular
workflow
to
create
what
could
be
better
in
our
opinion,.
D
Another
key
point
for
operation
is
going
to
simplify
the
troubleshooting
process
and
therefore
also
here,
as
we
are
witnessing
the
netiv
cloud
context
in
a
process
of
adoption
of
the
concept
of
observables
through
tracing,
in
our
opinion,
policies,
as
code
must
also
to
benefit
from
all
this.
We
have
an
integration
with
open
telemetry
that
allows
us
to
go
and
collect
trio
event's
from
the
policies
and
then
go
and
process
them
and
finish
them.
D
For
example,
in
this
case
within
jaeger,
and
here
we
have
a
screenshot
of
jaeger,
where
we
can
analyze
in
the
specific
the
evaluation
process
of
a
cube,
request,
rne
itis.
So
here
we
have
a
breakdown
of
all
the
various
phases
that
the
policy
went
to
do
to
leverage
this
request
with
timing,
and
also
with
all
those
that
can
be
messages.
The
context
information
linked
to
the
evaluation
process.
D
It
follows
that
having
an
integration
with
open
telemetry,
there
is
the
result,
also
extremely
easy
to
go
and
integrate
with
prometheus,
to
have
meters
that
regard
the
policies
and
consequently
have
what
is
the
universe
of
dashboard
graf
ana,
alerting
with
prometheus.
The
key
concept
is
that,
even
in
this
context,
policies
are
considered
first-class
citizens
in
the
clown
context.
Netiv
are
in
all
respects,
like
regular
applications.
D
D
We
realize
that
arriving
at
this
stage
in
which
there
are
already
projects
that
address
this
issue,
there
are
those
who,
for
example,
may
have
made
investments
in
this
space,
both
in
terms
of
knowledge
and
time
policy,
energies
and
whatnot.
Now,
open
wrists,
gatekeeper
agent
were
the
first
projects
in
this
space.
Both
use
a
language.
Those
language
is
not
a
program
in
language,
with
all
the
benefits
and
the
consequent
pros
and
cons.
I
do
not
intend
to
criticize
this
because
there
are
indeed
in
all
honesty
of
the
contexts
where
perhaps
having
a
query.
D
Language
like
rigo
may
perhaps
be
better
than
having
a
programming
language
and,
at
the
same
time,
from
the
point
of
view
of
the
developers
you
may
be,
it
could
be
useful
to
use
rigo
in
certain
cases,
rather
than
using
go
now,
I'm
anything
else
from
the
point
of
view
of
operation.
Instead,
maybe
there
was
an
investment
in
going
to
use
policies
found
or
written
ad
hoc.
D
You
don't
want
to
go
and
lose
all
this,
but
at
the
same
time
you
don't
want
to
go
and
introduce
yet
another
one
other
workload,
our
clusters
to
maintain
operate
in
local
resources
with
tatro
here's.
The
good
news
is
that
rigo
can
be
compiled
and
web
assemblies
and
you
do
it
using
just
an
official
tour
of
openpolis
agent.
What
we
did
was
to
go,
extend
our
runtime
to
ensure
that
he
was
also
able
to
understand
how
to
execute
these
policies
produced
starting
from
the
line
now.
D
Another
very
interesting
note
in
my
opinion,
is
that
there
is
a
rift
within
the
world
of
openpolis
and
gatekeeper
people
as
integration
of
openpolis
agent
with
cooper,
the
itis
and
gatekeeper
provide
different
formats
as
regards
the
input
of
the
jacksons
to
be
evaluated
and
the
output
produced
then.
Consequently,
if
I
write,
neither
policy
in
line
I
have
to
think
about
whether
I
will
enforce
it
through
the
integrating
openpolis
jesi
il
with
cooper,
nitish
or
via
gatekeeper,
because
they
are
not
interchangeable
in
our
web
assembly
standardization
process.
D
What
we
did
was
was
to
iron
out
these
differences,
and
so
the
end
result
is
this:
we
have
what
we
call
a
universe,
a
wrists
platform,
the
cube
ordan
within
which
we
can
have
policies,,
let's
say,
native,
to
keywords,
written
partly
blackish
or
anything
else,
and
then
we
can
also
have
policies
that
were
originally
written
in
the
line
as
a
target
offer
or
the
line
as
a
target
that
who,
for
these
policies,
become
web
assembly
files,
which
are
managed
with
the
traditional
workflow.
That
I
showed
you
before.
Briefly,
nothing,
therefore,
they
integrate.
D
D
Now
I
would
switch
to
what
is
a
demo
and
for
today's
demo,
I
want
to
put
myself
in
the
shoes
of
an
operator
who
wants
to
go
and
apply
a
policy
in
the
your
cluster
to
do
some
compliance
with
regards
to
the
keywords
used
by
the
various
coburn
itis
objects.
So
here
I
show
a
site
called
policy
hub
where
the
various
keyword
policies
are
collected
and
going
here,
I
can
say:
ok
as
operator
I
want
to
go
to
make
filters
on
the
bubbles
and,
coincidentally,
I,
find
this
policy.
D
I
can
go
worse
than
the
policy
in
this
case.
I
want
to
immediately
start
playing
for
a
moment
with
the
policy
now,
instead
of
going
directly
to
a
coburn
itis
cluster,
whether
it
is
also
a
testing
one.
We
think
it
is
much
more
productive
and
we
will
see
going
to
experiment
with
the
policy
outside
of
the
q
berny
tease
to
do
all
this.
We
have
created
a
command
line
tool
called
that
from
bliss
itl
with
an
unpronounceable
name.
D
However,
the
imagination
on
the
names
nor
mi
convention
on
the
strangest
and
most
difficult
things
in
the
world
of
iti
kg
ab
city
l
has
a
command
line
interface
that
deliberately
resembles
that
of
docker.
So
we
can
go,
for
example,
to
see
what
are
the
policies
that
we
already
have
available
on
our
computer.
Now,
the
formatting
is
married
because
you
enlarge
font,
but
you
can
see
that
I
have
a
list
of
policies.
The
policies
are
cut
as
if
they
were
regular
black
images.
D
Therefore
specific
tags
latest
ag
I
can
also
go
and
reference
a
policy
using
its
from
gestures
in
such
a
way
as
to
have
an
immutable
reference,
and
then
there
is
a
column
whose
formatting
gives
me
some
information.
For
example,
this
is
a
family
policy,
shaun,
yes
or
no
another
series
of
actions.
Now
the
policy
we
want
to
try
does
not
exist.
We
have
not
downloaded
it
yet
and
so
we're
going
to
download
it
to
download
it.
We
use
the
pool
command
a
bit
like
doc
airpool.
D
D
The
policies
change
over
time
a
bit
like
the
software
and
the
policies
changing
evolving
over
time.
They
can
also
change
the
way
they
are
used.
They
are
configured
ok,
so,
instead
of
going
crazy
trying
to
trace,
which
was
the
way
of
configure
the
policy
in
version,
0
15
compared
to
0
16
changed
something
or
go
and
see.
Ok,
but
this
policy,
what
kind
of
operations
does
it
analyze?
What
kind
of
resources
does
it
analyze?
Instead
of
going
to
find
these
formations?
D
D
As
regards
the
operations,
it
is
interesting
to
see
how
the
operations
here
are
operations
that
only
concern
the
create
or
the
update.
Finally,
here
we
have
what
is
the
documentation
of
the
policy.
Therefore,
written
policy
of
four
is
also
what
is
especially
interesting
with
dario
use
it
policy.
Now
we
want
to
use
this
policy.
We
want
to
practically
simulate
this.
This
scenario
in
which
I
downloaded
it
I
want
to
see
if
this
policy
actually
does
what
is
advertised
and
if
I
can
use
it
do
what
are
the
requirements
so
I
registered
a
cuper
request.
D
D
To
do
this
a
bit
like
a
dock
eran,
we
can
also
do
it:
dub,
syria
and
iran,
which
takes
a
series
of
parameters,
including
those
that
are
the
configurations
of
the
policy
and
the
polis,
the
object
to
analyze
and
the
policy
itself.
Now
we
are
going
to
execute
a
policy
and
as
a
request,
we
put
that
there
must
absolutely
be
a
le
ball
called
cost
center,
and
this
the
apple
when
present,
has
this
satisfies
this
regular
expression?
Now
the
policy
has
been
executed.
D
The
final
result
that
this
request
would
have
been
accepted,
perfect
as
operator
and
now.
I
want
to
quickly
hope
on
this
policy
to
go
and
find
the
right
configuration
that
satisfies
the
use
in
the
various
cases,
and
then
I
run
the
policy
again
this
time
requesting
that
there
is
another
mandatory
lever
called
on
air.
If
there
remember
this
well,
the
apple
was
not
there.
D
We
ask
the
ram
with
all
the
various
policies
that
we
have
in
place
in
our
cluster.
The
same
thing
can
also
be
done
to
maintain
to
be
sure
that
our
policies
actually
do
what
we
want.
Those
who
do
then
have
batteries
of
a
the
tests.
For
our
policies
that
continue
to
run
every
time,
we
go
change
everything
I'm.
D
B
A
very,
very
interesting
press.
We
have
a
few
minutes.
I'll
ask
you
a
few
questions.
Then
you
can
go
on
in
the
chat
to
drink
and
chat
about
the
topic.
Discussions
go
on
from
tons
of
people
linked
here.
I'm
sure
you
can
continue
there
too.
So
first
question:
you
said:
support
for
juan
smith.
Swift
is
not
mature.
What
is
the
status
for
other
languages
,
which
ones
are
better
to
develop
by
sammy?
Then.
D
The
language
at
all
perfect
for
rast
web
assemblies,
then
I
understand
that
not
everyone
knows
or
supports
web
assembly,
but
there
is
web
assemblies
web
assemblies
in
the
sense
that
some
languages
years
support
web
assemblies,
but
the
binaries
web
assemblies.
The
products
are
designed
to
run
inside
a
browser
which
means
that
at
runtime
go
request.
A
number
of
functions
which
lost
has
to
provide
is
usually,
for
example,
go.
D
The
official
go,
compiler
creates
binaries
and
assemblies
creates
javascript
files,
which
then
the
browser
to
use
to
provide
these
functionality,
which
is
missing
for
the
go
project,
for
example
city
in
the
mouth,
an
alternative
compiler
that
supports
web
assemblies
and,
alas,
unfortunately
it
does
not
support
everything.
The
dico
language.
However,
you
can
write
policy
swift.
It
is
immature
only
from
the
point
of
view
of
the
size
of
the
binaries.
For
the
rest,
I
must
say
that
it's
a
language
that
works
really
well
via
script
assemblies,
which
is
a
d
type
script
dialect.
D
B
D
The
policies
are
not
put,
they
do
not
contain
any
and,
let's
take
I,
didn't
explain
myself.
Well,
I'm.
Sorry,
let's
take
the
point
web
you
look
like
and
then
we
create
a
so-called,
namely
and
artifact,
which
is
a
format
provided
by
siae
speck
to
store
objects
other
than
containing
images
inside
a
registry
container.
D
B
D
Question
so
we
are
working
on
an
integration
with
the
sic
store
project.
It
is
a
project
that
is
part
of
the
linux
foundation,
which
is
having
an
incredible
attraction
that
allows
you
to
go
and
sign
and
verify
various
types
of
artifacts.
It
started
to
contain
images,
but
it
can
be
used
for
also,
I.e.
and
artifact
and
other,
and
therefore
what
we
are
doing,
go
integrate
into
siiq
store
to
have
use
sic
store
to
sign.
The
policies
contains
the
verification
at
the
time
of
the
policy
pool.
B
D
Can
using
these
pipe
lines
in
another
way,
for
example,
in
my
opinion,,
everything
would
go
very
well
with
tools
such
as
argo
flux,
fleet
to
then
go
and
propagate
the
various
custom
resources
of
who
warner
so
go
and
do
well
force
while
everyone,
the
clusters
that
we
exist
in
a
centralized
way
with
db
tops
of
the
policies
here
is
our
why
I
would
follow?
Ok,
we.