jnardiello

Mate, I've been working in this space for long enough to know exactly what I'm talking about.

Podman, Buildah, Skopeo and Crun are ALL redhat projects. OSS = Open code (ok) + Open Governance (not ok). In the "containers" org there are currently 23 maintainers, 99% RedHat employees (with a few indies - you always want students contributing for free). This is a great example of enterprise OSS shitshow, whereas a large org register a fake org on github with an intended "open" name - but keep close control on the governance of projects and tries to push (implicitly) its technological stack as a standard.

Disclaimer: I fucking hate enterprise vendors.

As an opensource lover, you gotta appreciate redhat registering a "containers" organisation with rh-only maintained projects. True OSS philosophy at work here!

don't! I happen to know them in person: they are super nice and super knowledgable!

No worries, this is a simple web-based UI - maybe you want to check out a more complete solution like Styra?

Not related to OPA. This is not an admission webhook, nor deals with gatekeeper and such, it does not enforce policies. It's a simple abstraction on the certs creation mechanisms and native Kubernetes RBAC.

Entirely different use-case. This is a simplified way to create new users, templates and distribute certificates to access a cluster. It does NOT integrate with external ldaps/ad/etc..

You are entirely correct, we started this project as an internal tool to be used in any environment where no integration with IAM/OIDC/LDAP/AD/etc.. was available (we handle LOTS of clusters and many of them are in this situation).

So, this is mostly recommended (as you said) for smaller projects/teams/orgs but we figured out this would still be useful to many so we just open sourced it.

It's also entirely true that you can use it in any cluster, as Kubernetes under the hood does NOT have any concept of "user" it's just a bunch of certificates with some roles attached, so you can actually deploy it anywhere and you can use to release certs on the fly for your users.

As for gitops, that's a great questions we got asked a few times today. It's just no there right now, this is a nice web ui wrapping RBAC primitives. We'll surely be working on it soon.

Hopefully, this was clear. Let me know if you have more questions.

My biggest problem with Slack is: how do we make it fit with tickets and the normal workflow? Also, if you don't reply real-time to customers you actually frustrate them.