~/ nmadiraju.com Amazon EKS · Policy as code
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Policy as Code Works on Amazon EKS

Follow an ECR-only image rule in namespace shop from audit to enforce, through Deployments and a webhook outage, then check yourself with 8 questions.

1Visual Walkthrough

An EKS API request traced through authentication, RBAC and admission webhooks to a Kyverno policy engine Left, a developer with kubectl. The EKS API server handles each request in five stages: authentication, authorization, mutating admission, validating admission, then etcd, with a built-in ValidatingAdmissionPolicy below. The cluster holds namespace shop with Deployment web, its ReplicaSet, Pod miner and PolicyReports; namespace kyverno with the Kyverno admission controller; cluster-scoped webhook configurations and policies; kube-system; and OPA Gatekeeper. The walkthrough shows a Docker Hub Pod accepted, audited, then denied; a Deployment checked by autogen; a mutation; a webhook outage and its fix; and the in-tree and Gatekeeper alternatives. Dev · kubectl user shop-dev EKS CONTROL PLANE · API SERVER 1 · Authentication IAM role → user shop-dev 2 · Authorization (RBAC) may shop-dev create this? 3 · Mutating admission may change the object 4 · Validating admission allow or deny, no changes 5 · Stored in etcd the object now exists ValidatingAdmissionPolicy CEL, run by the API server + binding: Deny in shop built in, GA since 1.30 EKS CLUSTER shop-prod NAMESPACE shop Deployment web ecr: shop/web:2.4 3 replicas ReplicaSet web Pods 3/3 ready creates web's Pods Pod miner docker.io/random/miner running PolicyReports fail · Pod miner fail · web, RS, Pods NAMESPACE kyverno Kyverno admission controller svc kyverno-svc:443 · 1 replica answers each AdmissionReview: allow or deny Pod · node-a Pod · node-b Pod · node-c 3 replicas, one per node: the HA minimum kyverno and kube-system: excluded by default CLUSTER-SCOPED OBJECTS Webhook configurations Mutating + Validating ValidatingPolicy ecr-only validationActions: Audit MutatingPolicy team add team=shop if missing ConstraintTemplate K8sAllowedRepos · Rego K8sAllowedRepos ecr-only enforcementAction: deny NAMESPACE kube-system aws-node · CoreDNS excluded from Kyverno's webhooks by default NS gatekeeper-system OPA Gatekeeper runs the Rego audit → Constraint status

    2Quiz to check understanding

    Check yourself