Policy as Code

Chapter 4. Policy as Code and Kubernetes

In 2018, I took over leading a team that was building tooling to provision Kubernetes, similar to Kubernetes the hard way. We were building tooling, mostly using Bash shell scripts, to provision and manage clusters. I had been working with Kubernetes part-time for almost two years at that point. We had considered tools like kOps to help build and upgrade clusters, but at the time, kOps did not meet our cloud computing needs.

Tip

Even with the automated services, platforms, APIs, and tools available today to help folks build and manage Kubernetes, I recommend that you investigate and try running Kubernetes the hard way. That experience was invaluable to my learning curve.

One of my first tasks was to implement controls inside Kubernetes to prevent unwanted cluster changes. We held an internal hackathon to help generate ideas about Kubernetes controls. That is when I first used PaC for Kubernetes and discovered how I could integrate policies into the Kubernetes API.

In this chapter, we will explore how PaC is used with Kubernetes to build controls that prevent unwanted changes, to erect guardrails that guide best practices, and to perform authorization. I will introduce concepts about PaC and Kubernetes integration, using examples where necessary. In subsequent chapters, we will dive deeper into each PaC solution.

I will start by briefly reviewing the CNCF and introducing Kubernetes community organization; then I will ask you to hit the ...