►
From YouTube: Workshop6 : Kyverno
Description
Kyverno (which means “govern” in Greek) is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate any configuration data or Kubernetes resources plus ensure OCI image supply chain security. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline.
While the declarative nature of Kubernetes makes it very powerful, and provides self-healing capabilities, it also greatly increases the amount of configuration that has to be managed. To properly declare and control state, Kubernetes provides a lot of configuration knobs – and these will keep growing over time as new capabilities are added. Another challenge is determining whose responsibility it is to configure the right settings, for security, best practices, and standardization.
The solution to this challenge is to use policies to validate configurations for best practices and security compliance, and also automatically modify and generate additional configurations when needed.
If you are operating Kubernetes environments, check out Kyverno to help address Kubernetes complexity and easily enforce security and best practice policies across clusters and workloads.
A
So
hello,
everybody
welcome
to
the
juvenile
shop
on
the
kubernetes
community
workday.
So
we're
very
excited
to
be
able
to
speak
here
and
just
right
before
we
start
this
workshop
a
little
a
quick
introduction
of
the
speakers.
Today
we
have
critique
pandy,
venkatesh
and
me
myself
here
petiquentish.
Would
you
like
to
introduce
yourself
a
little
bit
more.
B
D
A
Thank
you
pratik
and
blacktisch
hello.
Everyone
again,
this
is
my
shooting.
This
is
shooting
down
and
I'm
currently
working
on
the
mother
as
a
senior
software
engineer,
and
so
I'm
leading
the
kubernetes
project
development
as
well
as
help
manage
the
equivalent
releases
right.
That's
about
me
so
a
quick
overview
of
today's
topic.
We're
gonna
start
with
kubernetes
policies.
What
can
the
policy
does
do
for
you?
What
can
they
achieve
and
then
we're
going
to
talk
about
a
little
bit
more
about
caverno
and
try
to
understand?
A
What's
what
are
the
operation
modes
of
kubernetes
and
how
that
can
help
in
your
quantities?
Cluster,
with
like
the
security
and
automating
the
configurations
and
then
we're
going
to
review
the
architecture
of
kubernetes
together
like
what
does
it
mean
if
you
install
kubernetes
as
an
emission
controller
in
the
cluster
and
also
what
are
the
like
available
tools
inside
kevin,
for
example
the
cli
and
after
that,
we're
going
to
look
at
the
coveral
policies?
A
What
the
policy
looks
like
just
you
know
quickly:
go
through
the
policy
structures
and
then
we're
going
to
have
demos
for
different
types
of
policies
covering
like
the
major
features
in
kiverno,
and
also
how
you
can
use
coi,
locally
or
integrated
in
ufci
city
pipeline
to
test
and
verify
policies,
statically
right
and
then
I'll
pratik.
One
of
folks
today
will
demonstrate
the
sample
policy
library.
A
And
obviously,
if
you
have
any
questions
in
between
while
we're
presenting
or
demoing
the
the
policies
feel
free
to
post
it
in
chat
or
ask
lively
all
right
so
to
get
started.
We're
gonna
first
understand
what
are
kubernetes
policies
and
how
it
can
helps
in
your
kubernetes
cluster,
managing
all
different
configurations
of
resources
right,
so
policies
are
really
a
contract
that
can
be
configured
in
the
cluster
across
different
rows
that
are
sharing
the
class
or,
for
example,
the
developers
securities
operations.
It's
it's.
It
is
important
that
you
have
this.
A
This
kind
of
best
practice
standards
enforced
at
the
cluster
level
whenever,
like
you,
have
different
teams
or
the
roles
sharing
the
cluster
and
policies
in
kubernetes
can
do
a
lot
of
things
for
you
in
different
aspects,
for
example
like
to
manage
the
applications,
especially
the
part
and
workloads
in
the
cluster.
It's
really
important
to
prove
the
security
settings
and
even
to
automate
that
configurations
using
the
policies
and,
as
you
know,
kubernetes
is
extremely
powerful
and
in
its
declarative
configuration
of
resources,
it
can
be.
You
know,
trivial,
but
not
easy,
to
manage
those
configurations.
A
A
Like
the
the
developers,
the
ops
team,
your
security
team-
that,
especially
in
the
cases
you
want
you're,
sharing
the
same
applications
with
multiple
instances
like
as
a
sas
provider.
It's
it's
important
that
you
can
manage
those
configurations
at
scale
and
automate
as
much
as
possible
of
these
configurations
right
and
not
just
for
the
security
settings.
It
is
also
important.
You
know
to
promote
the
best
practices
for
the
cluster
and
also
have
that
sort
of
automation,
of
like
the
default
configurations
of
your
resources
and
constructs
in
the
in
the
classroom.
A
It
ensures
the
configurations
and
compliance
with
the
security
settings
and
best
practices,
standards
for
your
applications
and
resources
in
kubernetes
and
like
as
one
of
the
audience
raised
this
question
before
what
makes
kiberno
or
why
should
we
use
kiverno?
One
important
thing
is
that
kiverno
does
not
require
any
learning
curve.
You
do
not
need
to
learn
a
new
language
in
order
to
define
policies.
A
Everything
is
native
to
kubernetes,
so
you
can
reuse
your
con.
The
concepts
that
you
are
already
familiar
with
to
define
the
policies
and
the
declarative
manner
like
just
like
what
other
kubernetes
resource
does
and
last,
but
not
the
least
creating
and
managing
to
rental
policies,
is
easy.
It's
really
easy
to
use.
A
A
All
right
with
that
being
said,
kiverno,
like
all
different
features.
We've
introduced
in
caverno,
really
helps
simplify
the
kubernetes
policy
management
like
including
its
validate
mutate
generate
ability,
as
well
as
verify
the
container
images,
and
you
know
the
policy
results
are
stored
and
audit
in
this
policy
report.
Custom
resource,
which
was
originated
from
the
kubernetes
work
policy
working
group
that
can
be
easily
accessed
and
processed
using
a
group,
cuddle
command
or
other
similar
tubes
right
and
since
kverno
is
kubernetes
native.
A
It
supports
all
commodities
type
types,
including
custom
resource,
which
means
you
can
define
policies
in
any
of
the
resources
that
is
naturally
or
registered
in
the
kubernetes
cluster,
and
with
that,
the
labels,
the
annotations
or
those
sort
of
concepts
can
be
used
in
infernal
policy.
Definition
to
you
know,
select
and
filter
the
resources
during
the
policy
application.
A
All
right,
so
here
is
just
like
a
quick
reference
about
the
comparison
of
kubernetes
policy
engine
between
kiverno
and
opaque
gatekeeper,
as
some
of
the
folks
may
know
this.
This
gatekeeper
provided
integrated
in
kubernetes
and
it
leverages
oppa
as
a
policy
engine,
and
you
know
it
requires
you
to
learn
the
rego
in
order
to
define
the
policy
constraints
and
templates
as
such.
And
you
know
the
this
comparison
is
very
detailed
and
compressed
comprehensive.
A
The
recording
is
available
on
youtube,
so
feel
free
to
use
that
as
a
reference
of
the
comparison
between
different
policy
engines
in
kubernetes,
and
I
think
there
are
also
k,
rail
and
warden
and
other
policy
engines
that
are
available
in
kubernetes,
but
if
you're
interested,
we
can
check
this
offline
like
for
the
for
the
detailed
comparison.
So
just
for
your
interest.
I
attach
this
recording
here.
A
All
right,
so,
let's
look
at
some
of
the
common
use
cases
we've
seen
from
the
kiverno
users,
as
well
as
from
the
kirono
community
right.
So,
as
you
know,
pod
security
policy
is
one
of
the
fundamental
steps
in
securing
kubernetes
and
kubernetes
by
default,
provides
a
set
of
out-of-box
sample
policies
enforcing
the
pod
security
settings
on
the
on
the
on
the
pod
on
the
pod
itself
and
workload
as
well.
So
beyond
pod
security.
A
A
The
labeling
of
the
resource
and
injection
of
the
sac
car
container,
along
with
the
months
or
the
certificate,
is
another
like
an
interesting
use
case
that
you
can
use
to
policy
to
address
and
last
this
image
signing
or
to
verify
the
image
signatures
and
the
test
stations
and
securing
the
supply
chain.
Security
is
one
other
one.
Other
use
cases
that
has
been
you
know
become
the
top
priority
from
folks,
and
we
provide
out
a
box
image,
wi-fi
rule
for
that,
for
you
to
verify
the
signatures
and
others.
A
Okay
looks
like
there's
no
questions
here.
All
right.
Let's
continue
with
the
architecture
overview,
so
we've
talked
about
what
kirono
can
do
like.
How
can
you
use
kirono
policy
to
enforce
the
the
security
settings
as
well,
as
do
some
other
like
mutate
and
automating,
the
the
defaults
we're
gonna
review
the
architecture
of
kubernetes?
What
does
it
mean
if
you
install
kubernetes
in
your
cluster
right
so
basically
at
high
level?
Kirino
consisted
of
these
three
components.
A
The
first
one
is
the
sweatbox
server,
which
registers
as
an
emission
controller
and
leverages
the
kubernetes
admission
webpage
to
receive
admission
request
and
then
mutate
and
validate
configurations
in
those
resources
and
return.
The
emission
response
responses,
along
with
the
emission
response
and
the
second
component
here,
is
the
generator
controller.
As
you
know,
kiberno
has
this
ability
to
generate
resources
based
on
different
triggers.
A
The
generate
controller
here
keeps
watching
for
the
generate
request,
which,
by
the
way
is
another
custom
resource
managed
by
kiverno
and
then
applies
generate
policies
and
generate
resources
to
the
cluster
and
the
last
main
component
in
kiberno.
Is
this
policy
controller,
which
is
also
called
the
background
controller
which
periodically
scans
the
existing
resources
in
the
kubernetes
cluster
and
apply
policies
to
generate
policy
reports
and
store
it
as
a
pulse
report
cr,
as
I
mentioned
earlier
and
in
the
cluster,
so
that
you
can
view
this
historical
data?
The
policy
results
through
coop
cuddle
command.
A
And
you
know
if
caverno
operates
as
an
emission
controller,
you
can
match
and
exclude
resources
based
on
all
different
kinds
of
informations.
In
the
admission
request,
and
once
that's
that's
been
done
once
that's
completed,
you
can
filter,
you
know
you
have.
You
will
have
a
filtered
rules
set
of
rules
to
be
applied
to
the
resources
in
order
to
mutate,
inject
defaults,
validate
configurations
generate
new
resources,
as
well
as
verify
container
images
for
signatures
and
attestations
right
and
a
few
things
to
know.
A
That
is
when,
when
you,
when
the
parental
policies
are
applied,
there
is
really
no
dependencies
across
all
the
policies
or
the
rules.
So
each
rule
is
applied.
Dependently-
and
you
know,
the
response
will
be
returned
along
with
the
initial
response
and
you
can
reel
that
response
using
the
command.
So
if
you
send
the
request
using
cuddle
command,
you'll
see
the
result
immediately
and
if
you
have
like
the
validate
policy
defined
in
the
audit
mode
and
then
you
will
see
the
policy
result
in
the
format
of
the
policy
report.
A
Okay,
so
here's
a
quick
example
of
a
validate
policy.
If
you
look
at
this
partial
fragment
here,
it's
just
the
validate
policy
that
looking
for
metadata
in
your
kubernetes
pod
and
it
says
it
and
it
checks
that
this
label
has
to
be
present
and
matched
in
any
of
your
kubernetes
pod
right.
So
this
is
just
an
a
basic
example
that
is
nice
to
for
demo,
but
actually
in
the
real
world
there
are
like
more
complex
use
cases
which
can
be
addressed
using
kverno.
A
Logic,
all
right,
so,
let's
take
a
closer
look
at
a
validate
policy
right,
so
here
this
policy,
you
can
define
a
validate
policy
using
the
overlay
style,
with
patents
to
specify
the
desired
state,
and
this
central
policy
is
another
type
of
valid
policy
which
is
just
to
deny
the
resources
based
on
the
configured
or
the
given
groups,
resources
and
kinds.
So
this
policy
can
be
used
to
check
the
deprecated
resources
and
potentially
reject
the
resource
creation
and
within
a
validate
policy.
A
And
cabrino
generate
policy,
so
basically,
there
are
two
resources
involved
in
this
generate
policy.
We
call
it
the
source
resource,
which
is
basically
the
trigger
of
the
generate
policy
and
the
target
resource
which
can
be
defined
in
the
policy
itself.
To
you
know
just
to
specify
the
configuration
of
the
resources
you
want
kubernetes
to
be
created
to
the
cluster
and
as
an
example.
Here
it
is
a
like.
A
january
policy
contains
the
data
data
block
it'll,
you
know
physically
generates
this
new
network
policy
inside
the
namespace.
A
With
all
these
configurations
and
another
type
of
generate
policy
is
the
ability
to
clone
existing
resources
from
a
different
namespace
and
copy
inline
data,
and
and
generate
that
resource
into
a
different
name,
space
and
optionally.
You
can
keep
those
data
in
sync
across
namespaces,
or
you
just
want
to.
You
know
initially
copy
those
data
over
and
leave
it
there.
A
Okay,
so
let
the
last
type
of
policy
that
is
available
in
kubernetes
is
the
so-called
image
verification
rule.
So
you
can
use
that
to
verify
the
container
images
for
attestations
for
image
signatures
and
also
you
know,
query
the
data
from
the
image
information
configuration
that
can
be
leveraged
further
in
the
in
some
other
keyword.
A
C
C
So
there
are
two
ways
we
can
install
the
keyword.
Now
one
is
the
henshaw
in
char
installation.
If
anyone
is
preferring
hem
chart,
we
can
install
keyword
pro
using
the
hemi
chart,
your
norepo
or
artifact
hub,
and
the
second
one
is
using
the
yaml
manifest.
So
for
this
demo,
what
I
am
going
to
do,
I
am
going
to
use
the
drama
manifest
to
install
the
keyword
note.
So
just
we
need
to
copy
this
online
and
lets
first
check
what
my.
E
C
Has
so
I
have
already
installed
the
time
cluster,
let
me
check
the
name
spaces
which
we
I
have
so,
as
you
can
see,
I
have
just
basic
name
spaces
or
storage
in
the
cluster.
Now,
what
I'm
going
to
do
is
I'm
going
to
install
the
keyword
number
once
the
once
we
hit
this
command.
What
it
does
is
pull
bunch
of
the
crds.
C
C
You
can
do
cpl
gate,
power,
minus
and
keyword,
and
you
can
see
the
qr
node
installed
in
this
device
within
three
seconds.
Let's
start
with
the
demo.
So
what
I'm
going
to
do
is
I'm
going
to
demo
for
the
pod
security
policies,
see
the
pod
security
is
the
basic
and
the
requirement
of
the
kubernetes
cluster,
because
if
any
user
get
access
to
run
the
pod,
he
can
the
pod
manifest
allows
to
run
a
container
which
can
give
access
to
the
the
root
user
of
the
cluster.
C
What
this
command
does
it
will
give
me
access
as
a
root
user
for
this
cluster.
I
will
do
another
center
for
that,
and
also
it
will
elect
the
privilege
of
all
it
will
eliminate
all
the
privileges.
So
if
I
hit
enter
so,
as
you
can
see,
I
will
get
access
to
all
the
file
system
of
this
cluster
and
if
you
have
not
running
any
policy
engine,
then
it
will.
This
scenario
can
happen,
so
it
will
will
just
run
one
single
image.
C
So
the
the
qr
now
provides
the
pod
security
policies,
which
we
can
avoid
all
these
type
of
scenarios.
So
for
that
we
have
to
go
to
the
q1
documentation
and
then
we'll
go
to
the
policy
section
in
the
policy
sections.
We
have
a
depart
security
section
so
from
the
port
security
section,
we
have
this
customized
command,
which
will
pull
all
the
port
security
default
policies
and
it
will
apply
to
that
cluster.
C
C
C
Yeah,
so
all
the
policies
are
in
the
registered
and
all
the
policies
are
in
the
enforce
mode
and
by
by
the
way
the
sepal
is
the
short
form
of
the
cluster
policy.
So
if
I
run
that
same
command
again,
as
you
can
see
immediately,
we
get
the
policy
violations
for
that
the
command
line
we
don't
have.
We
have
to
drop
all
the
capabilities.
Then
this
command
will
escalate
the
privileges.
C
C
E
D
C
So
for
that
demo
I
am
going
to
use
the
same
command
and
what
I
am
going
to
do.
I
am
going
to
apply
all
these
policies
in
audit
mode,
so
we
can
see
the
the
policy
report
for
that
previously
we
have
in
the
enforce
mode.
So
that's
why
the
creation
get
blocks
immediately,
but
in
the
audit
mode
we
will
allow
to
create
the
resource,
but
we'll
create
the
policy
report
for
that.
C
C
C
C
So
so
this
way
we
can
create
the
policy
report
for
the
audit
mode
for
the
resources,
and
this
will
bring
me
to
the
third
third
demo,
third
type
of
feature
which
I'm
gonna
highlight.
So
when
we
create
write
the
policy
at
the
bot
level,
you
are
now
automatically
generate
generate
autogen
rule
for
the
all
the
pod
controllers.
So,
for
example,
if
I
write
a
policy
for
a
pod
and
then
if
I
create
the
deployment-
and
if
that
is
violate
that
rule,
then
automatically
it
will
get
blocked.
C
So
for
that
I
want
to
show
a
policy
called
require
labels,
which
should
be
just
explained
there.
So
what
I'm
gonna
do
is
here's
the
policy
structure,
so
we
are
matching
kind
pod
here
and
what
I'm
doing
so,
whenever
pod
get
created,
that
part
should
have
labeled
kubernetes
dot,
io,
slash
name
and
the
any
value
for
that.
C
C
Box
and
we
can
see
immediately
the
the
creation
get
blocked.
As
of
with
the
good
error
like
the
label,
we
should
require
the
label,
so
in
this
way
the
keyboard
has
a
feature.
So
if
we
created,
if
you
write
the
policy
for
the
poll
label,
it
will
automatically
create
the
rule
for
the
all
the
power
controllers.
So
if
we
go
into
the
yaml
of
that
policy,
we
can
see
here.
C
C
So
if
you
want
to
block
creation
of
resource
immediately
that
time,
we
can
use
the
enforce
and
if
we
want
to
allow
to
create,
create
the
resource,
but
we
want
a
violation,
so
audit
mode
will
create
the
violation
for
that.
So
it
will
create
the
report
for
that
that
this
resource
is
violating
this
rule
and
in
the
enforce
mode
the
direct
resource
creation
will
be
blocked
depending
on
the
user
requirement.
We
can
specify
that.
D
C
What
will
happen
to
them?
So
what
will
happen
that
time?
If
we
have
written
policy
for
that
and
it
will
and
the
background
scan
is
true
for
that
policy.
It
will
immediately
it
will
create
the
policy
report
for
that.
So
you
can
see
the
policy
report
in
the
policy
report.
You
will
see
that
this
deployment
is
already
violating
the
rule,
so
so
so,
as
I
showed
here,
as
you
can
see,
first,
I
have
a
few
policies.
C
A
Yeah,
just
one
thing
add
to
that:
if,
if,
if
you
have
the
like
the
resource
resources
already
scheduled
in
your
cluster
and
with
the
enforced
policy
configured
for
them,
caverno
would
essentially
blocks
any
updates
of
the
resources.
But
if
they're,
you
know
some
the
existing
resources
there
will
be
violations
reported
and
the
policy
report.
A
A
So
if
you
look
at
the
james
expressions
variables
physically,
we
provide
like
two
different
types
of
variables.
One
is
the
built-in
data
that
you
can
access
and
query
any
data
from
the
admission
review
request
and
also
the
user
information
along
inside
the
mission
request.
That
is
being
said.
You
know,
just
when
you
send
the
request.
A
This
information
can
get.
You
can
access
the
information
like
who
sent
the
request.
What
are
the
rows?
The
cluster
rows
defined
in
that
user
information,
as
well
as
the
image
properties
as
the
butane
variable
and
another
type
of
james
pass
variables,
is
that
you
can
do
the
external
lookup
through
any
of
the
existing
kubernetes
resources
or
from
the
external
oci
registries
right.
A
So
this
is
extremely
helpful
if
you
run
keyboard
noise
and
an
emission
controller-
and
you
know
you
can
substitute
those
variables
or
those
data
dynamically
from
the
given
or
existing
source
data
source
right.
So
if
you
take
a
close
look
at
the
different
source
of
this
data,
the
config
map
is
something
built
in
caverno
by
default.
So
if
you
go
to
next
slide,
there
will
be
a
policy
sample
policy
here.
A
If
you
look
at
the
spec
rules
context
here,
the
config
map
block
is
provided
by
kiverno
by
default,
which
you
can
specify
in
the
information
of
that
config
map
and
add
it
to
the
policy
contacts
with
the
name
dictionary
and
later
in
the
mutate
pattern.
You
can,
you
know,
query
any
of
the
data
in
that
complete
inside
that
config
map
and
use
it
to
either
mutate
as
a
label
or
use
it
in
the
validator
or
any
other
type
of
policies
for
later
consumption,
and
you
know
another
type
of
external
data.
A
You
know
verify
the
image
signatures
and
the
test
stations,
and,
if
you
have
like
any
of
the
configurations
of
the
inside
container
images,
you
want
to
use
or
verify
or
validate,
this
can
be
used
in
the
image,
verify
rule
or
any
type
of
other
keyboard
policies
all
right.
So
next
I
think
when
tishi
we're
gonna
have
a
demo
on
the
music
policy,
combined
with
the
variable
substitution
ability.
C
C
C
C
Okay,
the
policy
got
created,
and
now
I'm
going.
What
I'm
going
to
do
is
I'm
going
to
notate
the
resource,
I'm
going
to
create
a
deployment
and
because
we
have
deployed
the
policy,
so
it
will
going
to
mutate
the
sidecar,
static
containers
and
the,
and
it
will
take
the
you
know,
the
environment
variable
which
we
define
in
the
configmar.
So
let's
create
another
deployment
tip
ctl
here
right
here,.
E
C
C
D
C
C
So
if
we
want
to
add
the
default
resources
for
a
deployment
or
pod,
so
we
can
use
this
kind
of
this
kind
of
policy
where
here
we
are
adding
the
memory
and
cpu
to
the
pod.
So
if
any
part
which
don't
don't
mention
the
the
cpu
one
memory,
then
it
will
automatically
that
you
know
will
add
the
cpu
and
memory
for
that
part.
C
So
if
the
image
start
with
the
registry
called
bob.rake.com
and
the
any
tag,
so
if
that
match
with
the
incoming
part
of
the
resource,
then
it
will
create
the
image
secret
for
that
policy
and
also
same
for
the
validate
policy
which
I
have
already
demoed.
So
there
are
multiple
policies
defined
there.
So
if
we
want,
we
can
use
it
from
there.
C
Okay,
so
I
have
that
policy
already
there,
so
the
policy
will
look
like
this,
so
here
here
we
can
mention.
Also
the
first
rule
we
are
taking.
The
the
image
should
have
the
tag.
So
if
we
don't
have
tag,
this
resource
will
get
blocked
and
in
the
second
rule,
validate
image
stack.
If
this
resource
has
the
latest
stack,
this
policy
will
get
blocked.
B
My
screen
is
visible
yeah,
so
we
we
talked
about
various
features
of
governor
or
we
talked
about
the
varied
policies,
mutated
policy.
So
the
third
policy,
which
is
like
a
very
powerful
feature
of
no,
is
to
generate
the
resources
using
a
register
policies
or
either
clone
this
clone
the
data.
So
there
are
three
type
of
two
types
of
generate:
policies
can
be
done
based
on
the
different
rules,
so
one
of
the
role
is
clone.
B
The
clone
is
basically
to
clone
the
existing
resources
or
copy
inline
data
to
the
different
resources,
different
namespaces
right,
based
on
the
policies
or
matching
resource
type.
You
have
another
one
is
to
donate
the
data
itself.
So,
instead
of
instead
of
cloning,
the
data
you
can
generate
those
those
resources
as
part
of
policy
creation.
B
So
let
me
go
into
the
demo
hope
my
screen
is
visible,
so,
first
of
all,
as
an
example,
I'm
going
to
show
the
secret
getting
created
which
we're
going
to
create
it
and
then,
whenever
there
is
a
policy,
so
let
me
start
the
just
just
to
automate.
I
just
create
a
script
just
to
automate
everything
and
show
the
demo,
so,
for
example,
so
what
we
are
going
to
do
is
we
are
going
to
create
a
basic
secret.
B
This
is
a
basic
secret
called
princess
credentials
which
is
going
to
be
created
whenever
the
spacecraft.
This
can
be
used
as
a
in
the
form
of
like
whenever
a
new
space
got
created
and
you're
going
to
deploy
a
pod
or
something
or
powder
deployment,
or
something
right
this.
This
can
be
used
as
an
image,
full
secrets
and
the
private
images
or
some
images
which
require
credentials
to
be
used
to
pull
the
polar
images.
This
can
be
used
for
that.
B
So
just
let
me
show
that
how
the
policy
looks
like.
So,
if
you
see
the
policy,
it's
a
business,
it's
a
cluster
policy
which
name
called
as
a
sync
secret
right.
It
has
rules
which
basically
says
sync
image
full
secret
right,
so
this
is
on
the
this
is
looking
for
a
nice.
This
is
looking
from
a
matching
kind,
called
namespace
right
and
then
there's
a
generate
rule
right.
B
What
generator
tool
says
is
I'm
going
to
clone
the
data
from
the
resource
which,
which
is
in
a
default
namespace
called
grid,
recreate
the
thing,
but
what
secret?
I
just
showed
you
a
similar
name
right,
which
is
having
a
simple
username
and
password
data
just
to
show
the
basic
potentials
and
it's
going
to
generate
this.
It's
and
it's
going
to
generate
the
secret.
It's
going
to
generate
a
clone,
or,
I
would
say,
sync
the
secret
whenever,
whenever.
B
You
can
see
the
namespace
field
has
been
provided.
This
is
the
variables
we
just
talked
about
so
this
is.
This
will
get
the
namespace
from
the
resources
which
is
going
to
which
is
getting
going
to
be
triggered
resource
right,
which
is
here
our
namespace.
So
it
will
basically
populate
those
fields
and
hit
the
secrets
just
to
show
the
demo.
Let's,
first
of
all,
let's
apply
a
secret,
I'm
going
to
create
a
secret
secret
got
created,
which
is
a
default
name
space
right.
B
B
So
so,
if
you
see
the
policy
got
created
and
the
next
step
I
I'll
go
and
just
create
a
new
space,
any
dominant
space,
for
example,
I
just
go
and
create
an
alpha
name,
space
right,
so
name
space
got
created
and
if
I
now
next
step
is
to
verify
that
same
secret
got
created
or
not
right.
So
I'll
just
go
and
get
a
secret
that
exceeded
on
alpha
namespace.
I
just
do
hyphenamel
of
that.
I
can
see.
B
I
can
see
the
namespace
got
created
with
the
same
name
and
in
alphanamespace
right,
and
it
has
all
the
information,
for
example,
password
and
username,
which
is
like
in
a
decoded
form
right
by
default
and
as
part
of
that
as
part
of
that,
the
applied
configuration
which
is
handled
which
is
applied
by
the
actual
secret,
which
is
in
a
default
namespace
clone
or
basically
right.
So
we
can
see.
The
password
name
is
top
secret.
Username
is
admin
new
right.
B
So
if
you,
for
example,
if
you
go
and
create
some
other
namespace
all
right,
so
this
secret
will
be
cloned
to
all
of
the
namespaces
right,
so
as
part
of
validation.
Now
so,
if
you
can
see
in
the
policy,
we
have
a
field
called
synchronized
too
right
here.
So
what
this
basically
does?
It
tries
to
sync
the
secret
for
any
new
changes
which
is
done
on
a
generated
resource
right
for
for
here,
for
example.
B
Here
we
have
a
next
thread,
so
any
new
changes
which
done
on
this
resources
done
on
this
particular
secret
resource.
It
will
be
populated
or
broadcasted
or
will
be
closed
to
the
other
namespace
which
has
been
generated
using
this
policy
right.
So
just
to
demonstrate
that
I
have
a
new.
I
I've
just
created
a
new
secret
with
some
slightly
change,
basically
in
the
name
username,
so
I
just
added
admin
in
the
end
early.
B
E
B
Just
again
trying
to
get
the
secret
and
alpha
name
space
right.
So,
let's
see
if
chat
the
new
data
or
not,
so
you
can
see
if
you
see
the
annotation
part
it
can
it's
showing
here
that
admin
new
admin
got
updated.
It
used
to
be
admin
new
earlier
right,
but
it's
now
updated
to
admin,
new
admin
right
and
also
it's
part
of
the
decoding.
The
everything
got
decoded
as
part
of
secret
right.
So
you
can
see
the
password
you
username
will
be
decoded
to.
B
Similarly,
I
just
tried
to
violate
everything.
Everything
is
syncing
properly
right,
I'll
look
into
the
source
secret,
which
is
in
a
default
namespace
with
the
same
name
right.
So
if
you
see
here,
I'm
just
looking
into
the
get
trying
to
get
the
secret
in
our
default
namespace
right,
which
is
our
source
secret
right.
If
you
can
see
here,
this
has
the
whole
similar
data,
because
I
was
applying
this
applying
the
changes.
So
you
can
see
the
appliance
notation
has
been
up
last
of
that
conservation.
B
You
can
see
as
an
annotation,
so
you
can
see
the
same
thing
at
my
new
admin
and
that's
the
same
password
and
just
to
validate
username
string,
which
is
a
decoded
form,
looks
very
similar
just
to
validate
this
thing,
so
this
is
already
so
what
we
have
seen
is
this
is
kind
of
automation.
So,
whenever
a
new
namespace
got
created,
we
want
to
as
part
of
admin.
We
want
to
have
a
certain
policies
to
be
enforced
right.
It
could
be
a
generate.
B
It
could
divide
it,
it
could
be
mutate
right,
so
as
part
of
that
he
can
configure
some
secrets.
So
whenever
a
tenant
wants
to
create
an
own
namespace,
this
secret
will
be
cloned
and
cloned,
and
then
this
will
help
them
to
a
bad
date
and
as
a
part
of
image,
full
secrets-
or
there
is
a
very
many
use
cases
right.
So
this
is
one
of
the
examples.
Similarly,
this
is
another
example
to
clone
the
secrets
of
a
clone
generate
rule.
B
Right,
so,
if
you
look
into
this
policy,
this
policy
is
all
about.
Basically,
it's
add
a
network
policy
whenever
it's
looking
for
the
namespace
watching
a
namespace
right
main
space
kind
of
resource.
So
whenever
namespace
got
created,
it
has
to
do
some
operations
right,
so
what
operation
it
has
to
do
is
it
has
to
generate
something
generate
and
in
the
form
of
data.
So,
basically
you
can
see
the
same
kind.
It's
an
inline
data.
Basically,
if
you
look
into
this
pack
is
a
core
kubernetes
way
of
writing
aspect
right.
B
So
it's
like
fragmentation
of
the
same
resource.
So
here
it
will
go
and
generate
the
network
policy
with
an
a
space
and,
and
it
will
populate
all
the
fields
you
know
chat
and
then
create
create
the
object.
Similarly,
right
so
we'll
come
to
this
one,
I
will
just
try
to
try
to
add
this
in
an
actual
demo
which,
as
part
of
multi-tenancy,
which
is
like
how
to
how
we
can
achieve
the
multi-tenancy
using
a
given
a
policy
right.
B
So
as
part
of
the
as
part
of
that
demo,
I
will
cover
this
how
to
how
how
the
generate
generate
the
network
policy
of
whenever
the
name
space
got
traded.
So,
as
part
of
next
step,
let
me
go
and
show
the
how
we
can
achieve
the
multitenancy
right.
This
is
one
of
the
good
example
of
amalgamation
of
various
policies
or
various
rules.
B
What
kavina
has
so
I
just
clubbed
all
them
all
of
them
that
take
mutated,
validate
and
generate
truths
to
achieve
something
which,
like
can,
which
is
very
good,
to
have
a
multi-tenancy
network
right
multiplayer
is
the
cluster,
so
you
have
for
many
users.
You
want
to
use
a
namespace
as
a
service.
You
can
do
those
things
as
well.
So
us
again,
I
will
start
a
demo.
D
B
Okay,
so
we'll
look
into
some
certain
resources,
like
you
know,
a
generate
controller
has
certain
rules
and
permission
required
to
generate
some
resources
right
because
it's
like
it's
like
very
pinpoint
cluster
rules
and
permission
given
to
generate
generate
controller
or
coming
off
to
be
precise,
to
generate
certain
resources.
So
if,
if
you
want
to
give
certain
permissions,
then
only
domino
will
work
so,
for
example,
I'm
here
going
to
play
with
certain
cluster
cluster
cluster
roles
and
cluster
bindings
and
network
policies
and
other
resources.
B
So,
for
example,
I
just
added
those
resources
which
is
required
to
be
given
permission
right
so,
for
example,
cluster
bindings
and
cluster
rules,
permission
has
been
able
to
generate
a
service
account
right.
So
these
are
the
resources.
So,
as
part
of
that,
I
will
just
create
this
resource
right
and
the
next
step,
I'm
just
going
to
apply
the
policies
which
I'm
going
to
explain
when
I
go
through
the
demo,
how
these
policies
are
getting
used
and
how
we
can
understand
about
them
right.
B
B
Okay,
so
as
a
part
of
next
stress,
I'm
just
going
to
going
to
have
a
policy
which
basically,
which
basically
validates
all
right
when
it
reads
a
name
space
when
so,
whenever
a
namespace
got
created,
it
has
to
validate
that
that
name,
space
has
a
label,
matching
a
kind,
a
matching
key
called
type,
and
it
has
to
be
a
value
as
small,
medium
or
large
right.
So
let's
go
and
create
a
new
space.
B
So,
for
example,
I'm
just
going
to
create
a
namespace
without
a
label
right,
so
that
type
types
key
label
is
not
there
so
and
using
any
user
called
nancy,
which
is
has
given
some
permission
to
create
the
name
space
in
this
particular
cluster
right.
So
you
can
see
it
has
been
blocked,
saying
that
your
space
doesn't
have
a
label
matching
label
which
is
a
type
and
the
value
fields
are
small,
medium
and
target
right.
B
Large
sorry,
so
let's
have
an
example
of
a
simple
namespace
which
has
all
these
all
this
label
populated.
Already,
for
example,
you
can
see
I'm
going
to
create
a
namespace
called
test
which
has
a
label
type
and
medium.
So
once
you
apply
this
one,
it
will
be
simply
go
through
and
create
a
namespace
right.
B
So
these
two
we
have
two
policies,
two
crystal
policies
here
right
so
first
cluster
policy.
What
it
does
is
it
it's
again
have
a
certain
generator
rules
right.
So
what
this
generate
rule
does.
Is
it
create
a
cluster
role
right
for
this?
For
the
user,
which
is
going
to
create
a
namespace
and
it
will
have
an
annotation
called
the
winner,
dot
io,
slash
user,
with
a
matching
username?
Who
is
going
to
data
and
a
space
for
example?
Nancy?
B
We
just
did
it
right
and
it
has
certain
permissions,
given
certain
permissions
like
she
can
get
the
name
space
and
delete
the
namespace
once
she's
done
with
her
usage
or
her
task
right.
So
certain
permissions
has
been
given
here
and
then
what
is
a
next
generation
is
so
yeah.
It's
matching
for
the
namespace
call,
which
I
explained
earlier,
and
the
screen
generator.
B
B
And
the
third
policy
is
to
create
a
role
binding
to
give
certain
permission
or
admin
permissions,
basically
right
to
the
particular
cluster
role,
which
we
just
created
on
the
top
to
give
permission
to
the
particular
user
right
here.
So-
and
this
is
a
this
is
generate
rule,
and
then
we
have
a
mutate
policy
as
well
as
part
of
adding
an
a
space
label
right.
B
So,
as
I
explained
earlier,
this
policy
will
basically
wash
the
name
space
and
it
will
mutate
the
name
space
with
the
key
with
a
label
matching
a
key
called
kevin
dot
is
flash
created
by
which
will
have
the
user
information
who
the
user,
who
has
created
the
namespace
just
to
inform
other.
This
will
be
a
basically
a
much
more
required
metadata
if
you
have
a
bigger
cluster
and
you
want
to
maintain
the
namespace
as
a
service.
So
you
know
okay.
B
This
user
has
created
this
particular
namespace,
so
yeah
moving
further
I'll
just
go
and
create
a
namespace
test
right
using
I'll
just
try
to
get
the
same
namespace.
What
we
created
earlier
using
using
a
user
called
nancy
right.
So
if
you
see
we
are
successfully
able
to
get
the
resource
and
we
can
see
that
certain
required
labels.
We
just
talked
about
it's
already
set
here,
so
it
says
it's
killed
by
an
end
right
and
similarly,
just
to
validate
that
we
can.
B
We
can
take
example
of
any
other
third
party
user
or
anything
which
which
which
just
which
doesn't
have
certain
permissions
to
get,
get
or
get
or
delete
of
particular
namespace
right.
So,
if
we
use
instead
of
nancy,
we
can
use
third
party
user
or
any
user
which
is
doesn't
have
certain
permissions
right
you'll
see
that
it
will
fail
to
produce
that
right.
So
it
says
net
the
user.
It
doesn't
have
the
permission
so
to
get
a
name
space
or
delete
any
space
right.
B
B
B
B
So
if
you
have
a
small
recommend
requirement,
you
know
once
you
create
a
namespace
right
and
it's
matching
with
the
small
and
then
it
will
try
to
create
certain
limit
ranges
based
on
the
different
cpu
and
memory
requirements
right.
So
you
can
see
here
we
have
certain
certain
requirements.
Certain
memory
is
if
you
limit
and
limit
requests
has
been
set
for
the
type
called
small.
Similarly
for
type
called
medium.
B
B
B
B
So
as
part
of
validating
that
will
be
handling
and
validating
all
the
operations
right
so
because
nancy
has
certain
permission
to
basically
to
get
a
delete
right,
and
it
has
an
information
to
that
particular
name.
Space
called
test
right.
So,
as
a
user
nancy,
I
can
go
and
delete
the
network
policy,
but
as
a
as
a
as
a
policy
right,
but
as
a
because
given
or
has
a
generated
controller
running
running
as
a
process
looking
for
the
watching
for
all
the
events
right.
B
So
whenever
you
delete
something
it
has
to
validate
by
now,
it
will
watch
for
those
events
and
try
to
try
to
reconcile
everything
and
see
and
reach
out
to
the
desired
state
right.
For
example,
if
I
delete
this
netpoll
network
policy,
you
will
see
it
will
be,
so
I
just
deleted
the
network
policy
and
the
next
step
I
go
and
I
just
go
and
check
that
network
policies
that
still
exist
or
not.
So
you
can
see
that
network
policy
got.
B
So
it
goes
and
created
the
network
once
again,
so
it's
kind
of
robust
and
whenever
or
by
mistake,
someone
delete
the
resources
which
is
very
powerful
feature
of
given
to
basically
to
generate
and
look
out
those
things,
and
we
try
to
generate
the
resources
back
right.
So
this
is
very
powerful
feature
of
the
renault
which
is
specific
to
and
which,
which
is
very
unique
to
kavanaugh
as
well
right.
So
so
other
example.
B
So,
as
I
explained
earlier,
nancy
has
a
permission
to
get
and
delete
the
namespace,
but
the
user
net,
which
is
like
other
user,
which
had
the
senator
permissions
unable
to
do
that
right.
So
similarly
he's
trying
to
get
that
a
space,
but
it
won't.
It
got
failed
and
similarly
he's
trying
to
delete
the
namespace,
maybe
right,
and
then
he
again
got
failure
error,
saying
that
you
don't
have
certain
permission
to
do
this
operation
so
once
so,
once
we're
done
he
can
or
she
can
go
and
delete
the
raceway.
B
So
as
part
of
our
delete
task
has
been
done,
user
nancy
goes
and
delete
the
range
space
as
well
so
yeah.
This
is,
and
everything
is
done.
So
all
the
whatever
name
space
got
created
under
the
delete,
all
the
all
the
all
the
policies
and
all
the
validation
mutations
has
been
done,
using
a
policy
to
to
achieve
something
which
is
like.
B
B
Can
be
used
for
our
cluster
custom
resources
as
well,
so
if
we
have,
for
example,
I
take
example
of
storage
right,
so
in
case
of
open
abs,
you
connect
a
disk
connect,
a
device
to
a
nodes,
kubernetes
nodes,
and
then
certain
resources
will
be
kicked
in
and
that
you
can
use
the
so.
Similarly,
you
are
watching
a
new
space
here
right,
for
example,
you
can
look
it
look
it
for
a
particular
custom
resource.
B
Like
can
say,
block
device
claim
right,
block
device
which
is
basically
got
created,
and
the
generate
controller
then
kicked
in
before
this,
watching
that
particular
custom
resource,
and
it
will
try
to
generate
some
other
other
resources
like.
Maybe
it
can
generate
cloud
device
claim
or
it
can
go
and
create
a
pool
itself
right
and
that
tool
will
be
automatically
created,
so
user
don't
have
to
do
it
for
many
operations
he
has
to
watch
for
the
okay
blog
device
got
created.
B
B
Right
now,
no
so
currently
we
are
just
working
towards
kubernetes,
because
that's
like
effective
and
standard
of
container
orchestration
right
now,
so
I
think
we
are
not
doing
anything
right
now,
but
maybe
in
the
future
we're
not
sure.
If
something
come
up,
we
try
to
tune
those
things,
but
currently
that's
communities.
It's
like
whole
things
cycle.
A
Yeah,
you
can
use
kyberno
ci
out
of
your
kubernetes
cluster
just
to
test
and
apply
policies
locally
statically,
either
your
ci
cd
pipeline
or
on
your
local
machine
and
well.
I
think
we're
also
seeing
the
request
that
to
decouple
the
policy
engine
inside
converno
to
make
it
a
general
purpose
library,
so
that
you
can
reuse
the
logic
inside
kioverno
to
apply
the
policy
logic.
E
B
B
B
Yeah
so
as
part
of
image
verifications,
so
there
are
certain
certain
tools
or
certain
like
six
store.
Is
there
and
a
co-sign
and
also
it's
so
we
are
using
various
tools
to
kind
of
try
to
verify
the
images
and
will
credit
the
signatures
and
everything
right.
So,
let's
start
so
again,
this
is
like
a
mix
of
policies
here,
just
to
demonstrate
a
use
case
right
so
again
we
can
see
the
more
of
an
acclimation
of
different
kubernetes
rules
here.
B
So
this
is
a
policy
which
is
basically
which
is
going
to
block
all
the
non-root
things
right
of
the
non-neutral
resources.
So
here
we
are
watching
for
the
resource
called
pod
here
right
and
we
are
enforcing
these
policies
right.
You
can
see
the
value
failure.
Action
is
in
sports,
so
we
are
kind
of
enforcing
this
rules.
We
talked
about
different
rules.
Audit
and
force.
Are
there
right?
So
this
is
an
enforcing
thing,
because
we
want
to
block
in
the
front
of
a
user
right
so
and
certain
precondition
we
have.
B
So
we
are
looking
for
that
and
we
try
to
validate
the
validate
the
containers
right
and
we
are
looking
for
that.
We
are
using
the
context
lock,
api,
look
up
api
of
container
registry,
we're
trying
to
get
the
date
image
data
from
the
image
registry.
So
we
have.
We
can
confirm
different
various
major
https
of
the
image
registry
like
you
are
using,
and
then
we
are
trying
to
get
those
data
and
trying
to
trying
to
see
if
the
user
itself
has
a
permission.
B
It's
the
user
itself
is
a
root
user
or
not
right.
So
you
can
see
if
user
it's
a
root,
not
root
user.
It
goes
and
block
the
permission.
So
there
are
different
way
of
doing
that.
But
this
is
like.
We
are
going
and
fetching
the
image
data.
You
can
say
that
fetching
the
image
inspect
data
and
then
we
are
trying
to
validate
the
data
itself
and
if
it's
a,
not
non-root
user,
we're
just
going
and
blocking
it
so
just
go
and
apply
this
policy
right.
B
So,
for
example,
I'm
just
going
to
create
a
busy
box
image
here
with
using
I'm
using
a
dryer
and
ecosystem
server
just
to
just
because
I
just
don't
want
to
process
the
data
but
purchase
the
data
into
etc,
but
and
create
the
deployment.
But
I
want
to
trigger
the
validations
right,
so
all
the
mutation
standardizations
web
books
will
be
triggered
in.
So
I
just
using
a
right
and
server
thing.
B
You
can
see
the
I
created
a
root
user
access,
so
busy
box
image
by
default
comes
with
the
user
root
user
permission,
so
it
should
be
a
block
in
the
front
itself
yeah.
So
you
can
see
this
image
busy
box
container
deployment
got
blocked
because
saying
that
it's
a
validation
got
kicked
in
and
it's
saying
that
image
with
a
root
user
are
not
allowed
right,
so
it
validated
the
user
permissions
and
plot
interference
itself
as
part
of
further
variating.
B
E
B
After
the
all
the
validation
invitation,
so
you
can
see
it's
successfully
created
as
part
of
next
just
to
validate
that
it
happened
because
of
the
policy
we
have
created
that
block
user
root
user
thing
is,
I
just
go
and
delete
this
one
just
to
validate
the
stuff
and
again
try
to
create
a
root
user
base
which
has
a
duties.
The
permission
busy
box,
which
is
which
is
earlier,
got
blocked
due
to
pulse
install
right.
B
B
For
that
you
have
to
configure
a
contact
from
configure
php
earlier
you
so
that
now
is
duplicated,
and
then
you
have
to
look
for
certain
from
certain
user
groups
and
ids
instead
of
instead
of
blocking
the
other
non-nuclear
sites,
so
those
clumsiness,
and
so
many
other
factors
you
have
to
think
about
everything
and
those
thing
can
be
easily
done
with
policy
as
well.
So
this
is
one
of
the
better
great
use
case
of
given
as
well
further
moving.
So
this
is
other
policy.
B
I
have
just
to
demonstrate
the
scale
images.
For
example,
we
can
have
certain
certain
deployments
running
in
a
cluster
from
last
20
years
or
like
six
years
right,
but
they
are
now
outdated
and
we
want
them
to
be
updated
once
we
once
they
try
to
scale
or
scale
or
some
scale
or
try
to
redeploy
or
something
right.
B
So
here
what
we
are
doing
is
again
we're
watching
for
a
namespace
watching
for
a
pod
resource
right
and
then
again
we're
trying
to
doing
a
registry
lookup
to
get
the
image
data
similarly,
similar
to
the
preview
example
right
now
we
are
looking
for
an
image
and
then
from
the
image
data
we
are,
what
we
are
doing
is
we
try
to
get
the
here's?
Some
change
path.
Expression
kicked
in
and
we're
trying
to
get
the
time
size
data
right.
B
E
B
Went
and
create
this
policy
right.
Let's
wait
for
a
couple
of
seconds
or
let
the
policy
get
ready.
We
go
and
create
a
deployment
with
certain
old
image
here,
I'm
using
ubuntu,
18.01
ebay
and
I'm
doing
again
a
trial
and
server
just
to
trigger
those
books
right
not
to
pulsate
that
so
I
just
run
it.
It
should
be
blocked
because
it's
it's
like
more
than
whatever
the
time
we
have
provided
in
the
policy
right
so
see
you
can
see.
This.
Is
god
block
right?
B
B
So
just
to
me
just
to
validate
that
we
can
have
a
certain
policy
which
will
try
to
get
the
image
data
from
the
certain
lookup
data
for
image
line,
string
right
and
strike
to
whenever
they
try
to
mutate.
The
containers
try
to
make
the
images
right
or
contain
images
with
the
actual
judges
of
those
images
right.
So
it
will
go
and
try
to
do
that.
So,
let's
create
a
deployment
like
covering
right.
B
B
Now
I
apply
the
now
before
I
begin
up
by
the
policy
now
go
apply
the
policy
itself
right.
The
policy
is
created.
Now,
if
I
do
and
again,
if
I
do
so
here,
for
example,
here
there's
no,
that
just
has
been
suffixed
right.
You
can
see
the
images
covered
or
slash
given
itself
now,
because
I
applied
the
policy.
If
there
will
be
a
change
in
that
it
will
append
the
digest,
it
will
try
to
scan
and
get
the
image
hd
data
and
try
to
update
that
so
that
this
will
validate
it.
B
Okay,
we
are
using
the
official
signed
image
with
a
particular
digest
number,
which
is
very
data
everything,
so
there
is
no
there's.
No
tempering
can
be
done
right,
so
yeah.
So
for
certain
examples,
so
we
say
have
seen.
How
can
we
add
the
digest
number
now
next
sample
I
can
show
is
the
sec.
How
can
we
check
the
signature
of
the
images
as
well?
B
Linux,
community
based
back
project,
which
is
basically
work
around
the
supply
chain
supply
chain
tooling
around
that,
so
we
are
using
the
tool
called
cosine,
which
is
basically
to
can
be
used
for
image,
signing
and
verification
right.
Another
tool
is
falcio,
which
is
which
is
basically
a
web-based
identity,
identity,
management
solution,
which
we
can
simple.
We
can
also
say
that
it's
a
keyless
sign-in
feature
right,
so
we
are
using
going
to
use
that,
and
so
for
that
I
have
a
policy
which
basically
imposed
that
rule.
B
B
You
can
either
use
a
custom
secrets
here
if
you
don't
want
to
use
the
particular
secret
what
you
have
used
earlier
or
if
you're
working
on
a
air
gap
environment
where
you
cannot
access,
go
and
access
authenticate
through
a
network,
and
you
can
use
those
certificate
by
hard-coding.
It
here
itself
right
so
now.
This
is
on
the
use
case.
So
let
me
go
and
apply
our
policy
right,
so
I
can
see
policy
got
created
debate
for
a
couple
of
seconds
now.
B
And
we
should
say
it
should
be
blocked,
saying
that
container
doesn't
matter,
secret
doesn't
match
right.
So
it
says
image
verification
got
failed.
Signature
signature
mismatch
right,
so
it
got
significantly
just
to
validate
that
I
can
go
and
create
a.
I
can
go
and
use
a
cosine,
cosine,
tooling
library
right
so
just
to
check
the
if
this
image
is
signed
it
properly
or
not.
B
So
if
I
do
the
same
image,
what
I've
used
earlier
jim
pause
and
sign,
if
I
run
this
one
close
I'll
verify
that
image
particular
image
is
signed
or
not,
will
have
some
information
it's
signed
or
not.
So,
let's
see
so
yeah.
It's
a
cosine
given
give
us
the
error
that
there's
no
matching
errors,
no
no
matching
signatures.
So
it
says
that
may
just
not
sign
it
right
so
yeah.
So
that's
when
date,
our
thing
so
that
everything
is
working
fine
as
part
of
next
step.
B
Let's
go
and
use
the
image
which
is
signed
already
right.
So
I'm
using
a
certain
image
of
against
jim's
image
from
gym
registry,
which
is
called
demo
java
tomcat.
So
it's
an
image
which
is
already
signed
using
a
certificate
or
cosine
sign
thing
right.
We
will
see
this
successfully,
it
will
accept
by
the
cluster
and
it
will
certainly
gone
through.
You
can
see
it's
accepted
and
it
added
the
value
and
everything
which
is
required,
which
is
a
part
of
certain
policies.
B
What
we
are
going
to
discuss
about,
yeah
and
also
as
part
of
validating
we
just
go
and
verify
the
same
same
image.
What
we
have
used
to
just
to
deploy
it.
So
if
I
go,
do
cosine
verify
of
this
particular
image,
which
is
which
is
already
signed
as
per
the
policy,
and
we
see
what
cosine
shows
us
right
so
see,
cosine
shows
everything
it
stays
about.
The
cosine
claims
were
validated.
B
Everything
is
got
what
what
got
validated
with
the
this
particular
image.
With
the
latest
tag,
it
has
all
the
transparency
log
right,
which
is
verified
again
and
all
the
all
the
way
all
the
certificates
has
been
verified
against
the
falsehood
side,
because
we
are,
we
are
using
the
keyless
signing
feature
and
verification,
so
it
says
using
pulsio
to
verify
those
things,
and
it
has
all
the
data
which
is
talked
about
the
workflow
and
everything
and
all
this
stuff
right
so
yeah.
So
this
updates
everything.
B
Now
we
can't
talk
about
the
attestation
thing,
which
is
like
other
features
on
top
of
image
verification.
So
so
till
now
we
had
a
certificate
or
a
class
certification.
Verification
of
the
image
that
verifies
this
image
is
signed
or
not
right.
Similarly,
we
can
have
some
attestations
as
well,
which
can
talk,
which
can,
where
did
that
it
has,
as
bomb
has
been
cyclodex
type
of
swamp,
has
been
added
or
added
to
the
images
right.
B
B
That
here,
those
vulnerabilities
should
not
be
increased
more
than
10
right.
So
if
you
have,
if
you
have
an
image
or
maybe
a
older
remainder,
something
which
has
so
many
vulnerabilities
which
cause
the
actual
number
more
than
10,
more
than
10
vertices,
for
example,
even
the
signatures
are
matching.
This
will
not
accept
it
right.
So
this
is
one
of
the
example
you
can
just
do
just
to
just
before
just
image
signing
you
can
do
some
more
things
to
validate
those
images
like
illustrations
and
some
predictive
values
as
well.
B
B
C
Okay,
so
now
we
are
in
the
interesting
part
of
the
keyword
that
is
cli.
So
if
you
want
to
use
keyword,
so
we
can
use
as
a
pure
cla,
so
kiwano
cli
is
mostly
apply.
The
policy
and
the
test,
the
policy
with
or
without
cluster
running,
so
we
can
apply.
A
client
cli
with
apply
rule,
apply
command
on
the
cluster
or
without
on
the
cluster.
C
C
C
So
before
we
move
to
the
apply
command
demo,
just
I
want
to
show
how
we
can
install
the
qrno
cli.
So
there
are
multiple
ways
we
can
install
the
clr.
If
we
go
into
the
documentation,
part
of
puremociali
we
can
install
serializing
through
or-
and
so
I
have
already
installed
cli
in
my
system.
Let's
get
verified
keyword,
no
version
yeah,
so
I
already
installed
with
the
latest
version
of
cli
that
is
1.6.2,
so
let's
first
apply.
C
So,
let's
start
with
the
apply
demo
yeah,
so
qrno
cli
apply
command,
perform
dry
run
on
one
or
more
policies
with
the
given
set
of
input,
resource
and
import
resource.
It
can
be
the
original
context
cluster
or
we
can
pass
as
a
resource
as
a
file.
Also,
so
I'm
going
to
give
demo
for
the
both
and
see
if
we
apply
use
keyword,
apply
command
for
the
validate
policies.
C
It
will
give
us
a
result
as
a
pass
or
fail,
and
if
we
use
for
the
muted
policy,
then
it
will
give
us
the
mutated
resource.
So
we're
going
to
see
the
demo
for
the
both.
So
before
that
I
am
I'm
going
to
show
which
policy
I'm
using
for
to
use
the
qr
no
applies
command.
So
what
we
are
going
to
do
is
here
we
are
going
to
validate
the
name
space,
so
the
we
are
going
to
validate
the
default
namespace.
C
C
And
I'm
going
to
pass
the
current
context
of
the
cluster,
so
I
used
to
pass
as
advanced
cluster
5
and
as
we
can
see,
there
are
four
tests
fail
and
the
10
are
passing
and
we
are
showing
all
the
four.
So
as
we
already
seen,
there
are
a
part
called
engine
deployment.
There
are
three
deployment,
three
deployment
ports
which
happening
in
the
default
namespace
and
there
is
another
part
which
running
in
the
demo
part
which
you
know
default
option.
E
C
C
So
now
the
next
things
which
I
am
going
to
show,
which
is
the
text
command,
so
the
test
command,
is
mostly
using
the
ci
cd
pipelines
so
for
the
test
command.
We
can
give
the
local
repository
as
a
input
or
the
git
repository
as
a
input,
and
the
test
command
is
currently
test,
the
muted
and
the
validate
policy,
and
we
are
working
only
supporting
the
generate
policy
on
the
right
side.
C
We
can
see
the
structure
of
the
test
command,
so
we
need
to
pass
the
test
file,
so
we
need
to
pass
name
of
the
test
which
which
we
can
provide,
then
the
number
of
policy
and
the
number
of
resource.
So
we
can
provide
the
policy
path
and
the
policy
resource
path.
So
every
policy
is
going
to
apply
on
the
every
resource
and
the
rule
which,
which
is
our.
C
Sorry
going
to
apply
on
the
resource,
then
we
have
the
variable
section.
So
if
we
have
in
the
policy
we
have
variables,
we
can
define
our
variables
in
that
section
and
then
the
result
section.
So,
in
the
result
section
we
have,
we
need
to
provide
the
policy
rule
rule
name
the
resource
name,
the
kind
of
the
board,
and
what
is
the
expected
result?
We
are
assuming.
C
C
C
C
So,
as
expected,
both
the
test
cases
are
passed
because
in
the
first
test
case
we
are
expecting.
It
has
the
latest
the
tag,
so
we
are
expecting
and
the
actual
result
is
passed
and
the
second
test
is,
we
expected.
It
should
fail
because
we
have
passing
the
the
latest
type
and
if
we
change
here
to
any
other
tag
like
1.2
and
still,
we
are
expecting
that
it
should
fail.
C
So
that
is
not
going
to
happen
because
of
that
the
test
will
fail
and
if
we
change
the
result
to
expected
result
as
a
pass.
So
since
the
both
rule
will
get
passed
as
we
are
passing
the
latest
tag,
we
are
adding
the
tag
and
we
are
not
adding
as
a
latest
type
in
the
this.
Both
test
case
will
pass
for
this.
These
policy
rules.
C
Yeah
so
as
expected,
the
both
cases
are
passed
in
this
way
we
can
write
latest
test
for
the
all
our
policies,
and
now
we
are,
we
are
providing
the
local
repository.
So
currently
we
have
almost
100
plus
policy
and
we
have
written
test
cases
for
all
this
policy
and
if
you
want
to
use
all
the
policies
directly
from
the
git
repo,
so
we
have
command
us
for
that.
Let.
C
C
You
can
see
we
have
all
this
structure
and
for
every
policy
we
have
written
the
test,
dot
test
cases,
so
there
are
multiple
tests.
We
have
already
written
for
all
the
policies
which
we
have
so
and
almost
there
are
thousand
plus
tests.
We
have
already
written
further,
so
this
is
all
about
the
test
command.
C
D
C
C
So
what
we
are
doing
here
is
this
is
the
cubesating
raw
command,
which
will
gives
us
the
all
the
adjacent
output
for
this
pure,
no
parts
out
as
a
json
output,
and
then
we
are
using
the
qr
node
jp
command
and
we
are
taking
the
length
of
that.
So
we
have
currently
one
part
running,
so
we
get
output
as
a
one
and
another.
If
and
sometimes
we
get
the
output
in
the
in
this
context,
like
the
pod
output
in
this
context.
C
So
if
we
want
to
get
the
name
of
the
container-
and
we
want
to
use
that
in
the
policy
later
part,
so
we
can
use
as
command
so
what
we
are
doing
here,
we
are
using
the
qr
node
jp
command
and
then
we
are
passing
the
json
as
a
path
and
then
we
are
going
to
the
the
particular
path.
What
exactly
details
we
want-
and
we
want
to
use
on
that.
So
this
is
the
container
name
which
you
are
getting
exactly.
C
How
we
can
use
in
the
policy
like
here
is
the
example
we
are
using.
So
what
we
are
doing.
We
have
this
path
called
api,
a
slash,
superversion,
slash
pod,
so
we'll
get
all
the
details
of
part
running
in
that
cluster
and
then
we
are
checking
the
every
the
known
name.
For
that
part
response
is:
if
it's
mini
cube.
If
it's
manicured,
then
we
can
get
the
length
of
that.
C
C
B
B
B
So
there
are
so
many
contributions
come
from
the
community
about
the
different,
with
the
various
use
cases
of
with
various
use
cases,
they
have
different
policies
and
they've
thought
of
contributing
to
governor,
and
we
are
trying
to
maintain
those
as
part
of
sample
policies
as
well.
So,
as
you
can
see,
we
have
a
as
we
showed
that
on
the
demos
and
the
previous
slides,
we
have
a
generate
mutate
and
verify
images
policies
which
are
the
different
features
of
camera
itself.
B
If
you
go
and
click
on
the
generated,
so
we
have
tried
to
define
our
policies
on
based
on
the
policy
type
just
to
make
it
is.
It
is
easier
to
understand
the
use
cases.
Users
has
so
if
you
see
that
we
have
add
network
policies
which
we
just
found
on
the
demos
as
well.
Similarly,
we
have
add
quota
policies
right,
you
can
click
on
any
policies
and
we
have
some
detailed
description
about
the
policies.
B
D
B
Footer
or
sync,
which
we
already
talked
about
in
the
video.
Similarly,
we
have
a
muted
policy,
so
we
have
various
operating
policies
based
on
the
various
use
cases
either
either
you
want
to
because
psps
is
no
more
longer.
There
is
going
to
be
duplicate
companies
versions.
So
what
is
alternate
for
psp
site?
What
speedy
policy?
B
So
we
have
different
policies
which
try
to
work
for
the
those
which
try
to
do
the
similar
thing
about
psp,
speeders
and
then
adding
some
most
features
on
top
of
that,
as
well,
so,
like
add
certificate
to
a
volume.
So
whenever
volumes
are
created,
certainly
our
default
resources.
Whenever
you
create
a
certain
resources
or
default
resources
or
limits
will
be
created
or
some
photos
will
be
set
right,
just
just
just
to
control
the
keywords
of
multiple
services.
D
B
B
When
you
come
up
with
a
benefit
of
certain
resources,
so
there
are
so
many
either
either
you
can
add
a
part
proxies
either
you
can
use
some
safety
effect
labels
on
a
when
you
do
a
auto
scale
or
when
you
configure
outer
skill,
or
you
want
to
add
certain
say-
to
make
safe
to
evac,
annotations
or
labels
to
certain
resources
to
make
them
a
vector.
Certain
operations
can
be
automated
and
mutated,
with
the
policy
structure
so
yeah
either.
B
You
can
want
to
inject
a
sidecar
container
when
you
create
a
cycle
container
to
do
some
initialize
operations
and
then
your
main
container
get
kicked
in
so
those
can.
Those
kind
of
uses
can
be
done
as
well.
Similarly
low
for
shell
block
virginia
security,
vulnerabilities
came
in
some
days
back
right.
That
was
a
long.
There
is
number
of
people
who
are
talking
about
number
of
softwares
which
were
using
log4j
was
affected,
but
because
of
that
cv
error,
so
we
kind
of
have
those
validations.
B
B
B
B
B
So
those
kind
of
everything
has
been,
as
a
use
case
has
been
put
here,
and
you
can
just
click
on
any
other
policies
that
try
to
learn
about
those
things.
Similarly,
we
try
to
divide
the
policies
with
the
subject.
If
you
need
a
policy
around
pod
network
policy,
deployment
or
service
account
or
by
link
once
it
happens,
so
you
can
click
based
on
the
certain
resources.
You
can
click
on
the
on
these
labels
or
you
can
say,
and
you
can
get
certain
policies
like
if
you
want
to
have
certain
policies
around
persistent
volume
claim.
B
You
yeah
exactly
okay,
so
yeah,
for
example.
I
was
talking
about
the
perception
volume
thing
so
yeah.
I
want
to
limit
certain
persistent
volumes,
so
this
is
one
of
the
examples
just
started
here,
but
some
certain
examples.
We
are
coming
with
certain
more
examples.
We'll
just
try
to
add
those
examples
here.
So
it's
in
a
multi-progress
cycle,
so
yeah.
So
here
you
want
to
limit
the
certain
host
path
volume
which
has
matching
patterns
right.
So
these
are
the
policies
you
can
use
based
on
the
different
scenarios.
A
Thank
you
for
taking
vanquish.
I
think
those
are
really
helpful
and
useful
policies
that
address
different
type
of
use.
Cases
all
right
just
to
quickly
summarize.
Today's
workshop
as
kiverno
is
the
kubernetes
native
policy
engine
that
can
be
used
to
secure
and
automate
configurations
of
your
kubernetes
resources,
and
you
can
run
kiverno
either
as
an
administration
controller
or
as
a
cli
standalone
ci
to
integrate
it
in
your
cdicd
pipelines
and
also
you
know
this
with
four
different
types
of
cavernal
policies.
A
Combined
with
like
the
variables
streaming's
past
expressions
filters
and
all
the
features
we've
supported.
Kimrono
can't
handle
complex
policies
and
it's
it
has
been
approved,
approved
for
production
already,
and
the
last
thing
that
it's
most
important
kimono
is
really
easy
to
get
started
with.
You
have
all
the
we
have
all
the
sample
policies
from
our
library
and
it
works
well
with
other
kubernetes
tools
and
processes.
A
B
A
A
But
if
you
have
the
policy
reporter
installed
for
any
violations
like
I,
I
think
we
have
slides
for
that.
You
can
configure
the
different
targets,
like
the
slack,
elastic
search,
loki
and
all
the
others
to
send
out
the
notification.
It
is
not
with
the
cs
cd
itself,
but
it's
something
that
you
can
report
the
violations
of
the
result.
Lively
from
your
cluster
through
those
targets.
E
E
As
this
workshop
would
be
available
on
the
youtube
video
in
some
time,
so
we'll
do
that
just
lastly,
before
we
kind
of
sign
off
just
want
to
share
a
few
more
stuff.
So
as
this
workshop
as
an
entire
kcd
event
is
primarily
community
driven
and
we
are
basically
going
to
whatever
the
sponsor
money
we're
going
to
get
from
sponsors
right.
We
are
sponsoring
different
boot
camps
for
the
students
there.
E
So
last
year
we
sponsored
a
few
six
or
seven
boot
camps
and
out
of
that
three
to
four
participants
have
clear
ck
exam.
Similarly,
if
you
know
there
are
students
in
your
community
who
want
to
kind
of
join
in
this
ecosystem
and
they
need
to
kick
start
so
again.
This
year
also
will
be
giving
like
seven
to
eight
boot
camps
coupons
to
the
students.