KUBE-POLICIES: GUARDRAILS FOR APPS RUNNING IN KUBERNETES

Summary from the TLDR InfoSec newsletter

The Square team built an adaptive security layer on OPA for their Kubernetes clusters. Kube-Policies was designed to allow for a phased rollout process, minimal user disruption, support a robust testing framework, allow for extensibility and exceptions, and be observable. This post dives into the strategies used to accomplish each goal, such as using kind for testing and warning HTTP Headers for phased rollouts.