Securing the Future: A Walkthrough of Pulumi and Policy-as-Code for Robust Kubernetes Clusters

In this dynamic and engaging meetup, we will dive into the cutting-edge realm of Infrastructure as Code (IaC) by demonstrating how Pulumi can be wielded to efficiently orchestrate Kubernetes clusters.
Pulumi, a modern IaC tool, not only supports multiple languages but also integrates seamlessly with Kubernetes. However, building and deploying is just half the story. As security and compliance become paramount in the cloud, incorporating policies as code alongside infrastructure is vital.
Through live demos and hands-on examples, this session will unravel how to amalgamate Pulumi with Open Policy Agent (OPA), a CNCF project, to enforce fine-grained, context-aware policies.

CloudNative Prague Meetup

Transcript

1. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved Ringo De Smet Customer Experience Architect 19 June 2023
2. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
3. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 3 Architecture SCM Team Foundation Data Network Others IDEs Tools Packages Build Deploy Manage
4. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 4 Multi-Cloud Infrastructure as Code BUILD, DEPLOY, AND MANAGE ANYWHERE WITH A STANDARD WORKFLOW Cloud Native Clouds Core Features: • Any Cloud, Any Language • State Management • Secrets Management • Guaranteed Preview Plans • CI/CD Integrations • Webhooks • REST API • Automation API • Dashboards and Reports Infra Providers
5. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 5 Pulumi - High Level View • Pulumi Architecture • Language Host • CLI & Engine • Providers • State Backend •Pulumi Service •Cloud Storage (S3, …)
6. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 6 Pulumi - High Level View • Automate your infrastructure setup with 1 or more Pulumi projects • A project contains • a program: this is your “template” from which you can create stacks • the stacks: each stack is an “instance” of the program • One project can use info from another project as input
7. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
8. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
9. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 9 Pulumi - ComponentResource Language Host Pulumi CLI & Engine Pulumi Provider (e.g. aws) $ pulumi up runtime: nodejs Start Network + children provider: aws Start CREATE …
10. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 10 Pulumi - Multi Language Components
11. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 11 Pulumi - Multi Language Component Language Host Pulumi CLI & Engine Pulumi Provider (e.g. aws) $ pulumi up runtime: nodejs Start i80.nw.Network provider: aws Start CREATE … MLC (e.g. acme) Start Nw resources
12. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
13. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
14. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved
15. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved 15
16. Pulumi Confidential. © 2023 Pulumi. All Rights Reserved @ringods @ringods@hachyderm.io • https://www.pulumi.com/docs • https://www.pulumi.com/blog • https://www.pulumi.com/registry