Behold: A New Way to Deploy Pod Security Policies Using Kyverno! - Abhinav Sinha, Nirmata
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2023-01-09

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Behold: A New Way to Deploy Pod Security Policies Using Kyverno! - Abhinav Sinha, Nirmata

Since its genesis, Kubernetes has been the go-to container orchestration solution for enterprises in need of scalable containerized applications implemented on microservices architecture. Any application that is deployed within Kubernetes is executed through one or more Pods, which makes Pod security not just a major concern, but a necessity for Kubernetes clusters, and even more so for business-critical applications. To fulfill this need, Kubernetes introduced PodSecurityPolicy (PSP) in its v1.3 release. However, PodSecurityPolicy was officially deprecated by Kubernetes in v1.21 and has been entirely removed in v1.25, which was a step taken due to some major issues encountered by users throughout the years of its use which could not be addressed without introducing breaking changes. But the removal of PSP in Kubernetes v1.25 does not mean that it’s an end for Pod security. It has been replaced by the new Pod Security Admission (PSA) controller, which utilizes the Kubernetes admission control webhooks. However, it comes with some serious drawbacks as well. In this session, Abhinav will be discussing the usage of Kyverno for deploying Kubernetes policies and demonstrate the new way of deploying PSPs with requirement-specific exceptions following the release of Kyverno 1.8.0.