~/ nmadiraju.com Amazon EKS · Policy as code
arrow_back Back to nmadiraju
Visual Walkthrough · Identity and security

How Policy as Code Works on Amazon EKS

Follow an ECR-only image rule in namespace shop from audit to enforce, through a release and a Kyverno outage, then check yourself with 8 questions.

1Visual Walkthrough

An EKS API request traced through authentication, RBAC and admission webhooks to a Kyverno policy engine Left, a developer with kubectl. The EKS API server handles each request in five stages: authentication, authorization, mutating admission, validating admission, then etcd, with a built-in ValidatingAdmissionPolicy below. The cluster holds namespace shop with Deployment web, its ReplicaSet, Pod miner and PolicyReports; namespace kyverno with the Kyverno admission controller; cluster-scoped webhook configurations and policies; kube-system; and OPA Gatekeeper. The walkthrough shows a Docker Hub Pod accepted, audited, then denied; a Deployment checked by autogen; an image rewritten to ECR by mutation; a check skipped while Kyverno is down, and the fix; and the same rule in the API server and in Gatekeeper. Dev · kubectl user shop-dev EKS CONTROL PLANE · API SERVER 1 · Authentication IAM role → user shop-dev 2 · Authorization (RBAC) may shop-dev create this? 3 · Mutating admission may change the object 4 · Validating admission allow or deny, no changes 5 · Stored in etcd the object now exists ValidatingAdmissionPolicy rule run by the API server binding: Deny in shop EKS CLUSTER shop-prod NAMESPACE shop Deployment web docker.io/shopco/web:2.3 3 replicas ReplicaSet web Pods 3/3 ready creates web's Pods Pod miner docker.io/random/miner running PolicyReports fail · Pod miner fail · web, RS, Pods NAMESPACE kyverno Kyverno admission controller svc kyverno-svc:443 · 1 replica allows, denies or changes requests Pod · node-a Pod · node-b Pod · node-c 3 replicas, one per node CLUSTER-SCOPED OBJECTS Webhook configurations Mutating + Validating ValidatingPolicy ecr-only validationActions: Audit MutatingPolicy to-ecr shopco/* → ECR cache ConstraintTemplate K8sAllowedRepos · Rego K8sAllowedRepos ecr-only enforcementAction: deny NAMESPACE kube-system aws-node · CoreDNS excluded from Kyverno's webhooks by default NS gatekeeper-system OPA Gatekeeper runs the Rego audit → Constraint status

    2Quiz to check understanding

    Check yourself