►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Gatekeeper: Flexible, Shareable Policy for Kubernetes - Craig Peters, Mircosoft
How do you ensure your Kubernetes resources conform to your internal policies and procedures? Every organization defines rules governing where images can be deployed from and what labels all resources must include. These rules are essential to meet security, legal, and operational requirements. Join us for an introduction to the new Gatekeeper project being jointly developed by Google, Microsoft, the CNCF's Open Policy Agent (OPA) project, and the community. You will learn how to get started with the upstream policy library that includes rules for common scenarios like image registry whitelisting, label management, and more. You will also learn how you can extend Gatekeeper with your own custom rules and then contribute them back to the community. Finally, you will see how the same policies can be applied at different phases of your software's lifecycle like CI/CD and audit.
https://sched.co/NrpC
A
B
Okay,
it's
been
a
long
day.
The
reshuffling
of
the
schedule
has
caused
some
challenges
for
all
of
us,
and
so
I
wanted
to
apologize
first
for
beginning
this
talk
so
late
in
the
day.
I'll
do
my
best
to
keep
it
interesting
and
snappy,
and
maybe
we
can
have
an
interesting
conversation
about
policy,
which
sounds
like
a
contradiction
in
terms,
but
it
really
isn't.
B
B
Unfortunately,
I'm
up
here
by
myself,
you
don't
see
Tauron
standing
next
to
me,
because,
due
to
the
change
in
schedule,
Turin
had
a
conflict
at
this
hour
that
he
wasn't
able
to
get
out
of
so
he
sends
his
apologies
for
for
not
being
here.
I'm
also
feeling
the
pain
of
this,
because
what
you'll
find
in
the
discussion
today
is
that
I
understand
policy
fairly
well,
I
have
a
fair
amount
of
experience
with
it.
I,
however,
am
NOT
an
export
expert
in
open
policy
agent,
on
which
this
gatekeeper
project
depends.
So
you
know
we
can.
B
We
can
only
go
so
far
in
the
discussion.
So
if
we
have
questions
that
come
out
of
the
discussion
that
need
to
get
deeper
into
open
policy,
agent
Turin
is
here
at
the
conference,
and
we
can
find
him
tomorrow
to
dig
deeper
into
those
those
questions.
I'll
also
share
other
ways
in
which
we
can
collaborate
online
and
through
the
community
to
get
questions
answered
further.
So
without
further
adieu.
B
Okay,
I
already
answered
Who
I
am
I,
want
to
know
a
little
bit
about
who
you
guys
are
you
know,
I
I
want
a
show
of
hands
here
who
who
here
is
a
developer?
Building,
applications
that
run
on
container
infrastructure,
kubernetes
or
other
other
places
here
I
do
some
of
that
anybody
else.
Okay,
that's
great!
It's
about
two-thirds
of
the
audience!
Okay,
who
here
operates
kubernetes
clusters
for
those
developers
as
an
infrastructure
provider
me
too,
okay,
there's
some
of
the
same
fans,
but
also
some
different.
B
B
B
What
has
gone
wrong
for
some
people
when
they're
running
coup,
grenades
clusters
in
production,
for
big
environments
and
or
small
or
basically
any
time
you're
trying
to
do
anything
real,
a
container
orchestra
to
environment?
You
you,
you
can
always
shoot
yourself
in
the
foot,
and
so
these
kinds
of
tools
that
we're
gonna
talk
about
are
intended
that
reduce
the
risk
of
those
kinds
of
problems
coming
about.
So
so,
let's
kind
of
paint
the
scenario
for
a
minute.
B
So
when
we
all
got
started
building
our
clusters,
we
very
carefully
planned
out
how
people
were
gonna
use
them
right.
We
generated
all
of
our
our
back.
We
configured
it
so
that
everything
would
work.
You
know
only
the
right
people
can
have
access
to
the
right,
namespaces
that,
essentially
you
you
think
that
you've
got
everything
planned
out.
You've
got
run
books.
You've
got
ways
to
handle
errors
back
up
for
recovery.
All
that
stuff
is
ready
to
go.
Let's
ship
it,
let's
open
it
up,
all
of
a
sudden.
B
B
Has
anybody
here
ever
looked
at
their
cluster
and
said:
where
did
that
name
space
come
from?
Does
that
ever
happen
to
anybody
else?
Yeah,
and
then
you
look
in
the
name.
Space
and
you're
like
whoa,
there's
a
whole
bunch
of
pods
there.
What
what
are
they
anybody
else
yeah
and
then
you
look
in
the
pods
and
you
see
what
containers
are
running
there?
Oh,
my
god!
What
what.
B
Did
it
come
from
like
seriously
like
who
who
decided
to
pull
from
that
particular
repo
like?
How
did
we
manage
to
get
there
and
then
you
know
what
do
I
do
next?
What
happens
if
I
delete
this
like
who's
gonna
care?
Is
anybody
gonna
care?
Is
a
production
system
gonna
go
down,
you
know,
what's
the
impact
of
that,
so
you
know
you,
despite
your
best
plans,
you
know
you
have
to
make
things
available
to
developers.
They
have
to
have
some
freedom
to
move.
B
B
Kind
of
skip
over
the
psycho
that
the
previous
one
really
did
this,
so
you
know
essentially
when
you've
got
a
dynamic
environment.
You've
got
all
kinds
of
things
happening.
At
the
same
time,
lots
of
teams
have
kind
of
conflicting
goals:
you're
trying
to
share
resources
so
that
you're
not
paying
too
high.
B
The
administrative
costs
are
too
high
and
infrastructure
costs
and
then
you've
got
complexes
things
where
you're
doing
similar
things,
but
not
maybe
not
even
exactly
the
same,
but
across
multiple
infrastructures
right,
maybe
different
clouds
on-prem
in
a
public
cloud
and
things
kind
of
start
getting
pretty
crazy
right.
So
how
do
you
limit?
B
You
know
the
use
of
unsaved
images?
How
do
you
keep
track
of
who
created
what
resources
and
understand
the
purpose
of
those
resources
and
who
depends
upon
them?
How
do
you
keep
users
from
running
into
each
other?
Besides
namespaces
right,
namespaces
aren't
quite
enough
there.
How
do
you
make
sure
that
you've
got
the
right
tooling
in
place
to
create
observability
about?
What's
going
on
in
there
and
and
how
do
you
manage
the
cost?
So
you
know
those
are
all
the
kinds
of
questions
that
you
know.
B
In
my
experience,
everybody
runs
into
a
day
to
of
burning
that
foster
like
day.
One
is
fine.
These
Eros
good
we've
kind
of
got
that
pretty
well
solved.
At
least
cloud
providers.
Do
what
happens
next,
so
lots
of
things
happen
like
we
all
solve
problems
on
a
day-to-day
basis
by
using
common
tools
that
we
use
every
day
right.
So
the
first
thing
to
do
is
to
write
things
down
like
when
you
do
something
make
sure
that
you
document
what
you've
done
I
can
create
these
wikis.
B
B
So
the
question,
then,
is
the
question,
then,
is:
how
do
you
make
it
easy
for
people
to
accomplish
the
documentation
of
things
without
having
to
go
and
do
a
separate
manual
step
to
write
things
down
and
then
how
do
you
deal
with
the
limitations
of
our
back
right?
So,
like
I,
only
have
a
certain
limited
set
of
vocabulary
for
the
verbs
in
our
back
and
yeah?
B
You
can
extend
that,
but
that's
a
slow
process
of
going
through
the
community
to
define
you
know
what
do
we
all
mean
by
role
based
access
control
right
we've
got
a
fairly
solid
definition
of
what
that
is
today,
but
extending
that
is
a
slow
and
cumbersome
process
in
this.
Our
back
is
probably
the
wrong
mechanism
for
for
accomplishing
controlling
some
of
these
other
things.
So
you
know
we
can
maybe
agree
that
neither
of
these
approaches
really
completely
solves
the
problem.
You
can,
you
can
do
some
pieces,
but
you're
always
gonna
have
holes
there.
B
So
kubernetes
has
additional
capabilities
built
into
it.
On
top
of
you
know,
once
you've
authenticated
somebody,
you
know
who
are
they
are
they
allowed
to
access?
This
is
all
the
domain
right
of
our
back.
Then
you've
got
admission
control,
alright,
so
within
a
mission,
the
first
thing
that
happens
is
for
that
person.
Are
they
reaching
their
resource
code
limits
right?
Okay,
do
we
have
the
resources?
Are
they
allowed
to
create
new
things?
That's
great,
and
then
we've
got
this
thing
called
the
web
hook.
B
The
web
hook
then
has
access
to
all
of
the
metadata
about
the
object
that
somebody
is
trying
to
create
here
and
can
implement
rules
using
an
external
controller
right.
So
what
this
controller
does
is
allows
you
to
write
very
powerful
rules
to
define
what
can
happen
in
that
cluster
for
a
given
object
for
a
given
operation
right,
so
I'm
trying
to
do
something
to
change
an
object
in
kubernetes.
Is
that
allowed
that's
a
very
powerful
concept
that
I
can
do
that
late
in
the
process?
B
The
next
thing
is
well:
if
we
try
to
use
this,
it
does
allows
us
to
have
access
to
all
of
that
metadata
about
the
object
and
then
I
can
build
in
to
these
admission
controllers,
all
kinds
of
policies
right,
because
I
have
access
to
all
that
data.
I
can
block
privileged
containers.
I
can
say
certain
people
in
certain
contexts
can
can
create
those
containers
and
in
other
contexts
they
cannot
be
created.
I
can,
in
certain
contexts,
block
the
use
of
certain
image.
Registries.
B
B
B
You
end
up
creating
controllers
in
general
that
are
purpose-built
to
solve
the
problem
that
you
have
today,
and
the
policies
actually
end
up
changing
over
time,
and
the
challenge
is
that
you
don't
want
to
have
to
go
to
a
developer,
to
say:
I
want
to
change
the
resource
quota
from
X
to
Y
or
I
want
to
allow
additional
namespaces
to
have
additional
quota.
These
those
kinds
of
things
don't
make
sense
to
encode
in
your
code,
so
they
need
to
be
flexible
and
parametrized
for
different
environments
and
they
need
to
take
advantage
of
external
data.
B
So
you
could
write
a
controller
that
goes
and
queries
some
external
system,
like
an
accounting
system
or
an
audit
system,
to
make
a
decision
that's
great.
But
then
you
also
have
to
think
about
other
use
cases
like
what,
if
I
want
to
make
sure
to
validate
all
of
my
policies
as
I
change
them
and
I
want
to
do
them
in
kind
of
a
CI
system.
So
I
need
a
dry
run
mechanism
and
all
those
kinds
of
things
that's
great.
All
of
a
sudden,
it
starts
looking
like
a
very
sort
of
custom
set
of
code.
B
B
B
So,
let's
look
at
what
CR
DS
got
created.
It
created
one
for
the
configs
and
one
for
the
templates.
We'll
look
at
the
importance
of
that
in
a
few
minutes.
This
is
a
validating
web
configuration.
So
it's
a
standard
way
of
configuring,
the
web
hook,
and
we
take
a
look
at
that
you'll
see
here
that
it's
look.
It's
an
admission
web
controller
and
it's
implemented
in
the
gatekeeper
system,
and
it
applies
essentially
against
a
set
of
resource
resources
that
are
coming
in
through
the
kubernetes
api.
B
Let's
take
a
look
at
it
and
you
know
this:
this
is
we
all
kind
of
some
of
us
raise
our
hands.
You
know,
we've
we've
found
namespaces,
we
don't
know
what
they
are.
We
have
to
go
talk
to
a
bunch
of
people.
It
can
take
quite
a
long
time
and
eventually
we
find
that
somebody
created
this
and
then
they
moved
onto
it,
and
this
is
not
depend
on
in
any
way.
So
how
do
we
say
never
again
like
we're
not
going
to
allow
that
to
happen
anymore?
B
B
Let's
take
a
look
at
we're.
Gonna
look
at
one
of
the
constraints
here
here.
It
is
so
in
the
constraint,
we're
gonna
say
all
new
namespaces
must
have
an
owner
right.
So
it's
a
it's
a
constraint
of
kind
required
labels
and
we're
gonna
say
all
namespaces
must
have
an
owner
and
the
owner
must
fit
a
standard
template
in
this
case
implemented
as
a
regex.
So
once
we
apply
that
constraint
to
the
system
the
next
time
the
developer
comes
back
and
says:
okay,
I'm,
just
gonna
create
an
arbitrary
namespace.
They
can
they're
back.
B
B
It
tells
me
sorry,
you're
not
allowed
to
do
that.
So
here
it's
another
example
where
I'm
looking
at.
Let's
see
this
one
is
about
duplicate
service.
I,
say
this
is
a
policy
that
says
if
you're
gonna
create
a
new
resource
in
a
namespace,
it
can't
have
the
same
name
as
another
resource
in
that
net
same
namespace,
and
so
we've
tried
to
create
a
duplicate
one
and
we
got
back
a
very
meaningful
error
there.
B
So
eventually
the
developer
figures
out
through
what
those
pop
the
implementation
of
those
policies
they
get
their
application
up
and
running
and
everything
as
well
until
something
goes
down.
Let's
go
back
for
a
second
here:
let's
get
something
important,
so
they
finally
get
their
service
up
and
running
and
everything's
going
great,
and
we
never
so.
Why
did
their
system
go
down?
In
this
case
we
do
a
root,
cause
analysis
and
something
you
know
a
common
practice
for
all
of
us
developers.
B
Is
that
we're
we're
lazy,
but
we
also
know
that
we
want
to
be
taking
the
latest
patches
and
making
sure
that
we're
using
the
right
latest
image,
so
we
often
resort
to
using
the
latest
image
tag.
Like
that's
a
has
anybody
else
ever
like
done
that
I
use
latest
way
too
much
well,
it
turns
out
that
often
the
latest
has
a
whole
bunch
of
stuff
that
we
don't
yet
support
or
can
cause
unforeseen
circumstances,
and
it
turns
out
that
that's
often
a
cause
when
you
do
a
root
cause
analysis
of
a
big
outage.
B
So
let's
say
maybe
what
we
want
to
do
is
actually
not
allow
the
use
of
the
latest
image.
So
now,
let's
look
a
little
bit
under
the
hood.
There
are
two
pieces
to
implementing
policy
with
gatekeeper.
One
piece
is
the
template,
so
this
is
something
that
the
administrator
would
create
the
template.
This
is
a
template
called
kubernetes
band
image
tags
and
what
it
does
is
it
implements.
This
deny
rule
deny
rule.
This
is
actually
an
open
policy
agent,
syntax,
an
open
policy
agent
actually
does
the
work
of
enforcing
the
policies
for
gatekeeper.
B
It
says
you
know,
I,
look
at
these
attributes
of
the
input.
I
find
the
spec
I
pull
up
the
image
label
and
I
say
let
me
get
a
variable
and
compare
that
variable
to
the
image
label
and
if
they
don't
matter
if
they
match,
then
this
is
a
band
label
right.
So
here
you'll
notice,
it's
not
specified
that
the
latest
tag
is
the
one.
So
next
we're
gonna
do
we're
gonna
look
at
the
template,
so
this
is
the
actual
object
that
is
the
variables
or
the
constraints
applied
to
that
template.
So
what
it?
What
the?
B
What
the
constraint
did
is
it's
a
up
here.
I
can
see
that
when
I
look
at
the
labels,
the
label
that
I'm
trying
to
match
is
the
latest
tag
so
right
up
here,
right
so
I'm
trying
to
I'm.
Looking
at
the
latest
tag
and
I,
that's
the
tag
that
I
want
to
be
in,
and
so
here
I'm
actually
looking
at
the
object.
It
might
be
more
it's
easier
to
see
in
the
constraint,
but
the
constraint
is
actually
a
very
simple
object
and
that's
essentially
the
end
of
the
demo.
A
A
B
So
how
did
we
get
to
this?
So
when
we
looked
at
the
demo,
we
noticed
that
there
were
a
couple
of
things,
though,
there's
a
template
that
implements
the
the
semantics,
which
is
in
a
language
called
rego
re
geo,
the
open
policy
agent
understands
and
so
some
class
of
users.
We
call
them
administrators,
but
some
class
of
users
needs
to
understand
the
the
Rigo
semantics
and
then
there's
another
class
of
users
that
needs
to
understand
the
policies
you
actually
want
to
implement
using
those
semantics
right.
B
So
those
those
are
more,
the
the
the
admins
who
care
about
what
the
resource
limits
are
or
which
tags
shouldn't
be
allowed.
So
the
way
it
works
is
happily
as
kubernetes
objects,
so
gate
keeper
implements
open
policy
agent
as
a
set
of
CR
DS.
Those
CR
DS
are
watched
by
oppa
via
gatekeeper
and
it
watches
through
the
API
server.
B
Essentially,
the
template
ends
up
generating
the
policy
in
oppa
and,
like
I
said
before,
it
essentially
exposes
all
of
the
metadata
of
every
object
type
that
goes
through
the
admission
controller,
and
so
in
this
way
we
now
have
essentially
a
cloud
native
way
of
enforcing
policies,
so
some
people
have
rightfully
asked
well
what's
a,
why
gatekeeper?
Why
don't
I
just
implement
everything
in
open
policy
agent,
open
policy
agent
is
a
very
powerful
cross
context.
B
Policy
engine
that's
been
used
for
all
kinds
of
different
control
systems,
and
so
the
fundamental
difference
is
that
in
Opa
you
essentially
load
all
the
policies
via
commit
config
Maps
config
maps
are
traditionally
very
hard
to
kind
of
maintain
over
time
in
clusters
and
there's
essentially
in
OPA,
there's
no
library
of
standard
policies.
You
have
to
essentially
write
your
rego
from
from
scratch.
There's
there's
no
clear
way
to
do,
reuse
or
sharing
of
that,
and
that's
not
exactly
the
way
we
we
want
to
standardize,
standardize
that
across
multiple
clusters
or
multiple
environments.
B
So
what
we
did
with
gatekeeper
is
that
we
turned
these
into
custom
resource
definitions
so
that
you
can
manage
policies
as
objects.
The
way
that
happens
is
this
combination
of
the
templates,
which
we
looked
at,
which
contain
the
metadata
you
want
to
extract
and
the
rego
semantics
and
then
the
constraints
which
are
put
together
with
that
template
to
create
the
instances
of
those
CRD
policies.
B
Another
feature
that
we
added
to
gatekeeper
is
intended
to
make
it
easier
for
companies
to
get
from
point
a
where
we
are
today
with
say:
no
policies
implemented
to
point
B
I'm
completely
in
compliance
and
all
of
my
policies
are
enforced
without
killing
your
developers
or
your
administrators.
So
the
first
step
in
that
is
to
understand
in
my
existing
environment
what
objects
conform
to
my
policies
and
which
ones
are
out
of
compliance.
B
This
allows
me
to
say
over
time,
I'm
gonna
start
by
auditing
and
understanding
where
I'm
out
of
compliance
and
then
I
may
either
tune
the
policy,
because
I
may
decide
that
something
should
be
allowed
in
my
policy
and
then
eventually,
I'll
start
enforcing,
so
that
all
new
objects
have
to
conform
to
that
policy,
and
so
this
allows
sort
of
an
easier
on
ramp,
which
is
a
very,
very
important
thing.
In
a
lot
of
environments,
other
environments,
obviously
you
may
want
to
enforce
them
right
away.
So
where
are
we
in
the
lifecycle
of
this
project?
B
So
this
project
is
in
the
alpha
stage.
We
it's
working
great
we've
got
it.
I
can
actually
say
that
we
use
it
I'm
at
Microsoft
and
we
use
it
to
implement
the
as
your
policy
or
aks.
So
we
actually
have
a
a
preview
service
running
in
Microsoft
leveraging
exactly
this
technology.
We
also
have
other
vendors
who
are
using
this
technology
in
their
environments,
and
what
we're
doing
is
we're
trying
to
build
we're
at
the
stage
where
we're
trying
to
build
the
community
around
this.
B
So
we
need
more
hands
who
care
about
this
to
come,
get
involved
and
give
us
feedback
and
participate
in
in
the
development
of
it.
So
there
are
new
things
that
right
now
are
on
the
horizon
right
now
we
don't
support
mutating
webhooks.
So
the
next
thing
that
we're
looking
at
doing
is
doing
things
like
well.
B
If
somebody
requests
something
from
the
docker
registry,
maybe
I
want
to
point
them
to
my
private
registry,
for
example
right
without
in
a
silent
way,
so
they
don't
have
to
worry
about
it
right
so
mutating
with
web
hooks
are
one
thing
another.
Is
that
or
the
you
know
we
do
replicate
the
data
from
NCD
back
into
open
policy
agent
so
that
we
can
do
comparisons
across
multiple
clusters,
for
example.
That
will
also
be
useful
for
comparing
against
external
data
so
that
you
can
use
additional
context
in
your
policies.
B
So
that's
another
piece
of
work,
we're
also
working
with
cig
off
on
authorization
and
using
my
OPA
with
authorization
likely
to
not
actually
be
a
part
of
gatekeeper
but
a
separate
project.
The
audit
right
now
is
essentially
an
initial
attack
at
it.
We
have
a
lot
of
feedback
that
we
need
more
capabilities
there
right
now.
Gatekeeper
has
very
limited,
metrics
and
observability.
We
know
it
needs
more
maturity
there
and
right
now,
there's
no
tooling
around
creating
the
the
policies
you
there
is
a
dry
run,
so
I
can
create
a
set
and
kind
of
locally
test.
B
B
It's
a
you
know,
a
very
interesting
cross-section
of
people
across
a
number
of
different
organizations,
including
Google,
Microsoft,
Red,
Hat
and
and
many
others.
So
how
do
you
get
involved?
This
is
a
very
important
slide.
You
come
to
the
slack,
so
please
join
the
slack
community
for
an
open
policy
agent.
There's
a
cuckoo
noise
policy
group
and
you
know,
come
submit
your
issues
and
keep
track
of.
B
What's
going
on
through
OPA
gatekeeper
right
now,
the
meetings
for
the
community
aren't
at
a
very
Asian
friendly
time,
but
that's
something
we're
looking
at
fixing
I'm
pushing
for
having
a
Europe
friendly
time
and
an
Asia
friendly
time
in
North
America
some
warnings
or
nights
my
time-
and
that
is
the
end
of
my
presentation-
I
mean
I.
Think
we
have
one
minute
for
questions
if
there
are
or
I'm
happy
to
hang
out
afterwards
for
any
additional
questions.
Are
there
any
questions?
Real,
quick.