Kubernetes Policy Architecture

Kubernetes Policy Architecture An architecture diagram generated by Archify. Resource Policies · Usage limits and management · Policy Types Resource Policies Usage limits and management Security Policies · Security context restrictions · Policy Types Security Policies Security context restrictions Network Policies · Network traffic control · Policy Types Network Policies Network traffic control Custom Policies · User-defined policy enforcement · Policy Types Custom Policies User-defined policy enforcement ResourceQuota / LimitRange · Total caps · defaults and ranges · Policy Implementation Mechanisms ResourceQuota / LimitRange Total caps · defaults and ranges Pod Security Standards · Privileged / Baseline / Restricted · Policy Implementation Mechanisms Pod Security Standards Privileged / Baseline / Restricted Admission Controllers · Validate · mutate API requests · Policy Implementation Mechanisms Admission Controllers Validate · mutate API requests NetworkPolicy · Ingress / Egress control · Policy Implementation Mechanisms NetworkPolicy Ingress / Egress control OPA Gatekeeper / Kyverno · Admission-webhook policy engines · Policy Implementation Mechanisms · Add-on OPA Gatekeeper / Kyverno Admission-webhook policy engines Add-on Cluster Level · Policy Application Layers Cluster Level Namespace Level · Policy Application Layers Namespace Level Pod Level · Policy Application Layers Pod Level implement apply Policy Types Policy Implementation Mechanisms Policy Application Layers Legend K8s built-in Scope level Add-on engine Policy type

Kubernetes Version Support

  • • ResourceQuota · LimitRange: all versions
  • • Pod Security Standards: 1.22+ (PodSecurityPolicy deprecated in 1.21, removed in 1.25)
  • • NetworkPolicy: 1.8+
  • • OPA Gatekeeper · Kyverno: all versions (add-on)

Policy Engines

  • • OPA Gatekeeper: runs as an admission controller that intercepts API requests; policies are defined with ConstraintTemplate and Constraint
  • • Kyverno: YAML-based policies that validate, mutate, and generate resources