How deeply does Google Anthos in Action cover policy engine?

Explains request routing, denial, latency, and configuration examples, but defers policy creation.

Policy engine

A policy engine is a software evaluation system that decides whether requests satisfy declarative rules.

A policy engine evaluates requests against configured rules and decides whether they may proceed. With the ACM Policy Controller enabled, a ValidatingWebHook registers Gatekeeper as a Kubernetes admission controller. The API server sends object requests to Gatekeeper before admitting them. section 13.4.1

For a Pod creation request, Gatekeeper checks the configured policies for violations. A denial prevents the API server from creating the Pod and returns the policy error. Policies use constraint templates and constraints; a constraint can match Pod objects and specify dry-run enforcement. section 13.4.1

Evaluation typically takes about one millisecond, but a poorly performing policy can add system latency. Check policy performance when introducing custom rules. section 13.4.1

Table 13.2 Namespace exemption options (view table figure)

Process option	Results of exemption
Audit	Namespace(s) will not report audit results but will still be part of the webhook and sync processes.
Webhook	Namespace(s) will be exempt from the admission controller but will still be part of the audit and sync processes.
Sync	Namespace(s) resources will not be reported into Gatekeeper but will still be part of the audit and webhook processes.
*	Exempts the namespace(s) from all Gatekeeper processes.

Namespace exemptions can apply separately to audit, webhook admission, and sync, or to all Gatekeeper processes. Choose the process deliberately: a webhook exemption does not also suppress audit results. section 13.4.1

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

Open Policy Agentincludes · Open Policy Agent is an open-source policy engine that evaluates declarative policies against structured input to make authorization and other policy decisions.
authorization decisionproduces · An authorization decision determines whether a principal is permitted to access a resource or perform an action under applicable permissions or policy.
policy enforcement pointused by · A policy enforcement point is an authorization component that receives access requests and applies authorization decisions.
policy information pointuses · A policy information point is a component that supplies attributes and contextual information needed to evaluate an authorization request.
policyuses · A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.