Admission Controllers - Feat. Kyverno, OPA, Kubewarden, Cloud Custodian, and VAP (Ch. 3, Ep. 1)
Source: YouTube · DevOps & AI Toolkit · published Jan 10, 2024 · 1:00:37
This video compares five CNCF projects for Kubernetes admission control: Validating Admission Policy (VAP), Cloud Custodian, Gatekeeper, Kyverno, and Kubewarden, highlighting their unique approaches to policy validation and mutation 0:06.
Key Takeaways:
• Kubernetes Validating Admission Policy (VAP) is a built-in beta feature that offers efficient validation without external webhooks, ideal for simple rules and preventing policy engines from blocking themselves 13:54.
• Cloud Custodian is a Python-based tool that manages policies across cloud environments and Kubernetes using YAML, supporting both validation and mutation 18:27.
• Gatekeeper traditionally uses the OPA Rego engine but now supports multiple engines, including VAP, to reduce policy fragmentation and handle complex governance scenarios 22:46.
• Kyverno focuses on Kubernetes-native policy management using YAML, offering capabilities for validation, mutation, and automatic resource generation like quotas 28:38.
• Kubewarden leverages WebAssembly to run policies written in languages like Go, Rust, or Rego, providing secure, sandboxed execution and distribution via OCI registries 34:41.
The hosts emphasize that the best tool depends on specific needs like policy language preference, complexity, and required features such as mutation or external data access 5:56.
Sources:
- 0:06 Introduction to admission controllers and the five projects
- 13:54 Overview of Kubernetes Validating Admission Policy (VAP)
- 18:27(https://www.y
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello it's us again it's us again look at it look at it welcome to you choose welcome to you choose or Choose Your Own Adventure style show where we're going to go through the whole cncf landscape and this is the first episode of chapter 3 we're not going to go through the whole landscape today no no today Buckle in yes it's it's a it's a marathon now we're going to today what are we going to go over today Victor we're going to go through admission Pol admission controllers in kubernetes uh policies uh validations mutations all that ja we have a record number of projects we never had what what do we have five I think have we never had five projects in one category so it's going to be fun uh we're going to find out what it is how it works and stuff like that and all that in five minutes fiv…