Policy Controller

As explained in Google Anthos in Action

Policy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.

Policy Controller adds organization-specific guardrails to Kubernetes clusters managed with Anthos Config Management (ACM). Role-based access control determines who may act on types of resources; Policy Controller can enforce conditions on the resources themselves, such as requiring CPU limits on Pods or a cost-center label on Namespaces. It can also address conditions formerly handled by deprecated Pod Security Policies. section 2.8 section 11.2.3 section 13.3.1

Enabling the policy engine registers a validating webhook with the Kubernetes API server. For an object request, the API server calls the Gatekeeper service; a Gatekeeper Pod checks the configured policies. A denial prevents the object from being created and returns the policy error. Constraint templates and constraints supply the policy logic. section 13.4.1

Figure 13.1 Admission controller policy validation flow

Trace a Pod creation request through the API server, Gatekeeper, and the admission decision. section 13.4.1

A practical rollout separates policy scope from enforcement:

• Choose a constraint template and define a constraint that matches the intended resource kinds. Examples include rejecting privileged containers, requiring a billing label on Namespaces, and requiring container image digests on Pods. section 13.4.1
• Use `enforcementAction: dryrun` to inspect reported violations before enforcing a constraint. A privileged-container example reports violations in system Pods, illustrating why scope matters. section 13.4.1
• Configure namespace exemptions deliberately: audit, webhook, and sync exemptions affect different Gatekeeper processes; `*` excludes a namespace from all three. An unauthorized attempt to add the ignore label is denied. section 13.4.1

Require a billing label

A `K8sRequiredLabels` constraint can match Namespace objects and require a `billing` label. When admission enforcement applies, a request without the label receives a denial identifying the missing label. section 13.4.1

Policy checks add work to admission. The cited average is about one millisecond per evaluation, but a costly custom policy can increase overall latency. Test policies and exemptions against the resources they will affect. ACM policies used alongside service-mesh configuration may also reach every cluster managed by an external repository unless a ClusterSelector narrows their scope. section 13.4.1 section 13.7

How Google Anthos in Action covers it

How deep it goes

Traces admission decisions through Gatekeeper and illustrates constraints, dry runs, and exemptions, but defers detailed policy creation.

Examples

Shows privileged-container dry runs, billing-label denials, image-digest constraints, and namespace exemption configurations.

What it assumes

Assumes familiarity with Kubernetes objects and namespaces while explaining admission-controller behavior and introducing constraint templates and constraints.

What you can do after

Operate/configure it by scoping Gatekeeper constraints, checking dry-run violations, and selecting namespace exemptions before enforcing admission decisions.

How it connects

Connects Kubernetes admission controllers, Gatekeeper, constraint templates, role-based access control, and deprecated Pod Security Policies.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• Anthos Config Managementpart of · Anthos Config Management is a Google Anthos component for centrally applying policy and configuration to clusters and services.
• admission controllerimplements · A Kubernetes admission controller intercepts API requests after authentication and authorization, validating or mutating them before they are persisted.
• constrainthas part · A constraint is a condition or rule that restricts the permissible states, values, actions, or solutions in a system or problem.
• Kubernetes clusterconfigures · A Kubernetes cluster is a set of control-plane and worker machines managed by Kubernetes to run and coordinate workloads and services.
• Regouses · Rego is a declarative query and policy language for expressing rules over structured data, commonly evaluated by Open Policy Agent and related systems.
• PodSecurityPolicyalternative to · PodSecurityPolicy was a deprecated Kubernetes API resource for enforcing security constraints on pods before its removal.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.