►
From YouTube: Intro + Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei & Erica Von Buelow, Red Hat
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro + Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei & Erica Von Buelow, Red Hat
The Intro+Deep session for Kubernetes Policy WG will cover the basics of the WG process, what we have achieved and what we will be mostly working at in 2019. We will also cover will specific topics like unified policy object definition in depth
https://sched.co/MPl7
B
A
A
A
A
B
A
A
The
reason
for
this
requirement
is
that
the
current
design
requires
that
they
have
this
template
CRT
as
well
to
handle
this
population
problem.
So
the
multi-tenancy
working
group,
specifically
a
Eastway
from
google,
asked
this
question
like.
Would
it
be
possible
to
have
a
policy
engine
help
on
this
matter?
So,
in
a
nutshell,
just
can
policy
help
solving
the
customer
resource
population
problem.
A
The
proposal
pay
a
pro
proposal
here
is
just
to
use
policy
engine
compared
with
a
compiler
I,
compelled
down
to
the
two
keys
and
then
with
a
compiler
to
be
able
to
operate
on
the
tenant
policy
objects
and
then
help
basically
populate
our
back
network
namespace.
All
these
resources,
the
example
could
be
like
OPA
talking
to
the
gatekeeper
module
and
then
with
the
key
keeper.
We
have
the
tenant
policy
object
that
will
be
like
enforced
for
the
resource
population.
A
B
A
A
A
Automated
reasoning
group
lead
byron
cook,
who
is
great
my
research
in
the
area
of
formal
verification,
so
we
discuss
about
whether
it
is
possible
to
bring
for
modification
to
curators
policy,
because,
first
of
all,
we
want
to
make
sure
that
the
policy
itself
is
like
defined
correctly.
A
second
of
all.
We
want
to
see
if
it's
possible
to
validate.
You
know
that
the
policy
enforcement
is
correct
and
you
know
either
ahead
of
time
or
just
in
time.
A
So
some
background
knowledge,
I,
wouldn't
read
through
this,
so
this
is
related
to
SMT
if
you
are
familiar
with
first
of
all
check
all
that
stuff.
So
basically
we
are
putting
defining
like
constraints
for
policies
so
that
we
can
evaluate
them.
I
copy
this
from
Wikipedia,
so
you
can
really
later.
There
are
a
couple
great
open
source,
SMT,
solvers
CVC
for
from
NYU
and
Stanford.
You
have
z3,
also
very
famous
and
also
rosary
rosary
is
like
a
actually
a
language
can
can
use
this
SMT
solvers.
A
So
what
the
formula
is
above
is
basically
something
it
will
be
looks
like
for
more
verification
for
the
policies
you
can
get
more
nerdy
than
these
I
promise
you
so
for
this
direction.
What
we
are
looking
at
is
actually
basically
built
how
to
build
a
symbolic
graph
for
communities
pauses,
and
it
is
possible
that
for
each
domain
will
have
different
graph
representations,
for
example
from
the
for
networking.
By
the
way
alw
is
group
just
did
a
whole
like
graph
modeling
for
the
entire
Italy's
network.
So,
just
just
you
know
it's
possible,
it's
not
impossible.
A
So
for
networking
it's
like
flows,
you
can
flow
that
way
flow,
throw
back
right
for
multi
tendency,
like
I
said
it
will
be
like
a
population,
the
heat
or
so
the
graph
will
be
a
little
bit
different
and
for
security.
You
will
see
something
like
Security's
primary
parameters
right
so
for
the
like
for
the
outer
layer,
you
may
have
many.
A
C
Could
actually
just
go
back
and
stuff
there
I
know
like
the
multi-tenancy
working
group
is
where
we
get
all
of
the
youth
like
people
and
bring
on
the
crowd
and
everyone,
and
then
the
policy
working
group
is
where
we
get
to
nerd
out
and
because
people
are
too
scared
by
the
name
policy,
but
I'm
really
excited
about
the
work
like
that
we're
doing
with
AWS
here,
because,
like
one
of
the
problems,
I
think
with
policies
right
now,
is
it's
great
that
you
have
all
these
things?
Do
you
know
what
it
does?
C
Even
can
you
how
do
if
you
we
have
security
profiles
or
something,
and
we
say
that
this
is
a
hard
or
soft
multi-tenancy,
and
how
can
we
actually
know
that?
That's
what
about
what's
going
on?
How
can
you
make
sure
that
all
of
your
policies
together
do
what
you
want
them
to,
and
how
can
we
build
on
top
of
that
in
a
in
a
way
that
works
and
keeps
our
the
boundaries
that
we're
looking
for?
C
B
So
I'm
new,
looking
at
the
group
and
I,
really
like
the
idea
of
formal
verification,
for
example,
that
that's
really
really
useful.
But
one
of
my
interests,
I
just
want
to
see
if
it
actually
fits
in
here
is,
is
looking
at
things
like
sock,
1
policies
or
financial
policies
and
making
sure
that
we
can
formally
validate
that
within
kubernetes
or
some
of
the
other
like
audit
policies.
Is
that
something
that
would
be
sort
of
outside
of
this
or
in
parallel.
B
So
some
of
the
stuff
that
within
JP
Morgan
is
kind
of
along
those
lines
along
you
know,
we've
got
multiple
different
control
standards.
We
need
to
meet
with
greater
than
s
TLC,
to
sort
of
validate
that
and
then
I'd
really
like
to
take
it
into
the
form
of
our
verification.
So
if
that's
something
I
can
I
again.
If
that's
something
of
interest,
I'd
love
to
talk
to
you
guys
about
it.
A
C
Yeah,
if
so,
if
we
want
to
go
in
kind
of
we
can
I
can
go
into
a
little
bit
of
well.
How
are
we
thinking
about
policy?
What
is
considered
a
policy?
It's
a
very
broad
term
that
gets
thrown
around
a
lot
and
we
want
to
distinguish
kind
of
policy
from
security
or
from
configuration
or
many
of
the
other
kind
of
aspects
that
kind
of
get
blurry
to
people.
So
in
a
kind
of
formal
way
we're
talking
about.
C
We
have
an
I
like
subject,
identity,
a
rule
set
that
get
that
in
you
know
that
map's
the
outcome
and
perhaps
the
identity,
the
rule
with
the
state
current
state
into
some
kind
of
decision,
that's
the
kind
of
like
basic.
So
it's
there's
rules
that
are
making
a
decision
based
on
the
input
of
the
subject
and
the
current
state.
C
One
of
the
things
kind
of
thinking
about
is
why
what
has
worked
traditionally
for
policies
and
making
sense
of
this
and
what
hasn't
worked?
Why
have
some
systems
caught
on
and
worked
out
better
than
others
in
particular,
I
asked
it
was
why,
like
does
SELinux
seem
to
mostly
work,
even
though
no
one
can
understand
it.
C
What,
and
why
did
that
catch
on
as
opposed
to
there's
a
lot
of
other?
You
know
more
advanced
in
some
ways
models.
It
was
that
it's
actually
really
just
a
type
system
that
this
is
one
of
the
easiest
ways
for
us
to
reason
about
things
that
we
could
bring.
That
in
we
already
have
much
of
kubernetes
is
based
on
the
idea
of
these
resources
that
are
typed
somewhat
and
how
we
manipulate
those
objects.
C
The
next
part,
of
course,
is
we
need.
We
have
certain
places
that
we
want
to
hook
into
the
policy
of.
Where
are
these
decisions
being
made?
Can
we
make
sure
that
those
access
points
are
defined?
Well,
so
the
policy
hooks
we
have
the
life
cycle,
Network
pod,
there's
we
have
about
five
spots
that
we
that
kind
of
the
policy
gets
enforced
at
good
next.
C
Another
thing
that
we
would
like
to
explore:
more
is
kind
of
capabilities
based
access
control,
model
to
delegate
authentication
and
authorization
more
easily.
This
kind
of
ties
and
how
do
we
trace
the
state,
including
across
the
objects
in
kubernetes
capabilities,
are
kind
of?
Like
you
have
a
token,
you
keep
passing
on
the
access
to
the
object.
He
has
this
token
token,
which
defines
so
the
how
to
access
it
comes
along
with
the
scope
of
access
and
it's
kind
of
state.
So
this
sort
of
ties
into
how
we
can
better
utilize
our
jobs.
C
There's
great
projects
like
OPA
that
you
can
use
to
build
on
top
of
kubernetes
or
any
other
kind
of
framework,
but
I,
don't
we
at
CD
isn't
eventually
consistent
flat
co-state
of
the
world,
and
we
shouldn't
get.
If
we
get
away
too
far
from
that,
as
kubernetes
policy
objects,
we
lose
track
of
what
our
guarantees
I
think
really
are
about
the
system
that
makes
sense.
C
C
A
A
Justin
from
NYU
and
Justin,
coming
from
talker
and
folks
are
helping
with
the
security
assessment
for
projects
I
think
they
have
done
for
a
tough
notary
and
spiffy
yeah.
They
are
doing
it
now
for
open
and
there's
something
in
the
pipeline
as
well.
Another
broad
aspect
is,
of
course,
policy.
That's
why
we
are
here.
We
try
to
figure
out
a
overall
architecture
for
the
whole
cloud
native
system.
It's
not
only
for
communities,
but
also
you
know
you
consider
things
like
psyllium.
You
know,
spiffy
is
to
Nestle's
doctor.
You
put
all
the
things
in
perspective.
A
This
is
something
we
came
out
for
the
moment,
so
we
think
it
could
be
three
layers.
We
have
the
typical
control
layer
like
given.
It
is
right
and
data
playing
sitting
or
my
that
actually
dealing
with
the
flows,
data
flows
and
at
the
upper
layer
we
have
the
policy
layer,
we
have
policy
engine
like
OPA
and
we
have
the
compiler
like
it's
not
compiler
in
the
like
programming
language
sense,
so
it's
compiler
than
cou
compile
policy
down
to
what
kubernetes
understand
so
compiler
here.
A
A
one
example
could
be
the
open
pit
keeper
the
c
rd
compiler
option
and
also
from
a
verification
engine
that
we
are
looking
at.
So
these
three
basically
forms
a
loop
that
could
help
you
like
write
policies,
verify
policies
and
enforce
policies,
okay,
last
but
not
least,
get
in
touch
with
us.
We
are
a
small,
very
persistent
but
sometimes
passive-aggressively
schedule
working
group
just
give
a
shout
out
on
the
either
meeting
note
or
we
have
slack
channel
in
communities
or
the
sensitive
channel
select
channel.
A
Both
code
work
we
are
doing
case
study
is
like
podcast
is
very
interesting
to
do
that.
So
if
you
have-
or
you
like
you've,
been
working
on
any
project
that
you
think
is
policy
related,
we
can
do
like
a
studies
on
that
and
also,
if
you
have
like
research
directions
like
for
modification.
You
know
these
type
of
very
nerdy
things
that
we,
like
you,
know,
group
and
also,
if
you
have
KPS
that
dealing
with
policy,
you
can
add
working
group
policy
labels
there.
A
C
C
C
C
Yeah
yeah,
that's
one
of
the
problems.
Definitely
it's
like
well
I'll,
just
add
something
with
a
higher
priority
then,
and
it
starts
stacking
up,
and
these
can
greet
yeah
I
grow
and
you
kind
of
need
to
then
squash
them
down
somehow
and
then
yeah
yeah.
That's
that's
good
to
hear
yeah.
It's
always
really.
One
of
the
things
I
need
more
of
is
stories
of
you
know
in
production
uses
of
what
the
reality
is
like
I
can
talk
about
it.