BUKOLA AYODELE: Compliance audits
can be arduous, painstaking, time consuming tasks.
Let's see how Policy Controller simplified Oma's job
enough for her to leave work before dinner time on an audit
day.
Its audit day.
And as people responsible for performing audits know,
this is a time every month when Oma
feels overwhelmed, because she needs
to review whether the entire company's infrastructure is
compliant.
This typically involves many hours
of reviewing configurations, meetings with team leaders,
and analyzing running infrastructure to make
sure everything is compliant.
A lot of the time spent tracking down potential problems
would disappear if there is a way to automatically enforce
correct policy instead of having to track down
possible compliance issues.
It would be better to have a system that stopped them
from occurring in the first place.
Oma heard a lot about the new tools
that Charlie's team introduced and is
wondering if those tools can possibly help them.
After hearing their issues, Charlie
explains Policy Controller and how it can not only
ensure compliance, but also enable
audit logging of violations that were uncovered
when policies were introduced.
Oma is intrigued to say the least.
Policy Controller is a Kubernetes dynamic admission
controller that checks, audits, and enforces your cluster
compliance with policies related to security, regulations,
or arbitrary business rules.
Policy Controller enforces cluster compliance
with policies called constraints.
Constraints are a powerful feature
that allow for fine grain control over a cluster.
For example, you can enforce many of the same requirements
as pod security policies, but with the added ability
to audit your configurations before enforcing it.
You can limit the type of volumes
that can be mounted to pods, or even
control the repository a given container image can
be pulled from, and more.
Along with constraints, Policy Controller
also introduces constraint templates.
These allow you to define how a constraint works with delegate
defining the specifics of the constraints
to an individual or group with subject matter expertise.
In addition to separating concerns,
this also separates the logic of the constraints
from its definition.
So for example, if you have a family of applications
that will have to use a limited range of ports,
you can define a template like this to limit the range
but define that range with a constraint at implementation
time.
Oma's team decides to start requiring
labels on namespace that specify who the namespace owner is.
This is a good use of the K8s' required labels constraints.
In order to start using Policy Controller to add a required
label, Oma first creates a corresponding constraint
with the dry run mode set.
This allows Oma to monitor all the violations
without causing downtime.
Once this constraint is applied to the cluster,
Oma can view the audit by looking
at the constraint object logs.
She now has a list of teams and services to talk to.
After they fix the issues, she removes the enforcement action,
which means the default enforcement actions [INAUDIBLE]
takes effect, even stop, further policy violations
from occurring.
In the past, she used to have to follow up
with teams individually to retroactively track
down and fix policy violations.
Now, with Policy Controller, Oma has
a list of violations and a way to block them from occurring.
Policy Controller using a familiar GitOps approach
to enable policy rules for existing
conflicts and logs violations that do occur once enabled.
And best of all, because of Policy Controller,
Oma got to be home before dinner on an audit
date for the first time ever.
So that's it for Policy Controller.
Make sure to check out the description for links
to more resources on it.
And like and subscribe to the channel
for more videos about Google Cloud.
Thanks for watching.
[MUSIC PLAYING]