{"id":74965,"date":"2018-12-11T09:00:06","date_gmt":"2018-12-11T17:00:06","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/opensource\/?p=74965"},"modified":"2025-06-30T00:00:57","modified_gmt":"2025-06-30T07:00:57","slug":"announcing-kubernetes-open-source-projects-osiris-kubernetes-policy-controller","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2018\/12\/11\/announcing-kubernetes-open-source-projects-osiris-kubernetes-policy-controller\/","title":{"rendered":"Achieve workload compliance and scale-to-zero with new Kubernetes open source projects"},"content":{"rendered":"\n

Over the past year or so the Azure upstream open source team has been investing heavily in making serverless Kubernetes a reality. We firmly believe that the Kubernetes operational model can be simplified by removing the burden of managing VMs and by making containers first class compute runtimes on the cloud. From the beginning of this endeavor we focused our energy on an open source project called Virtual Kubelet. Today, we\u2019re taking the next steps in taking Kubernetes autoscaling to the next level by introducing a new project called Osiris<\/a> that enables scale-to-zero workloads on Kubernetes.<\/p>\n\n\n\n

We’ve also noticed a stronger push from the community to answer how Kubernetes workloads can be audited and have policy enforced at resource create. As a result, we’re introducing the Kubernetes Policy Controller<\/a>, which allows you to enforce custom semantic rules on objects during create, update, and delete operations without recompiling or reconfiguring the Kubernetes API.<\/p>\n\n\n\n

Read on to learn more about both new projects.<\/p>\n\n\n\n

Achieving scale-to-zero workloads on Kubernetes<\/h2>\n\n\n\n

Virtual Kubelet<\/a> has made it possible to dramatically change the auto-scaling properties of a Kubernetes cluster. Depending on the provider plugin, workloads can be scaled using Kubernetes native methods, like the Horizonal Pod Autoscaler, without having to provision additional VM-based nodes or even use a cluster-autoscaler. With Virtual Kubelet enabled auto-scaling, we saw an opportunity to further optimize workload availability and cost by enabling the scale-to-zero workloads.<\/p>\n\n\n\n

Introducing Osiris, scale-to-zero infrastructure for Kubernetes<\/h3>\n\n\n\n

Today we’re excited to announce a project called Osiris<\/a>, which helps users scale their workloads to zero. Osiris enables greater resource efficiency within a Kubernetes cluster by allowing idling workloads to automatically scale-to-zero and allowing scaled-to-zero workloads to be automatically re-activated on-demand by inbound requests.<\/p>\n\n\n\n

How it works<\/h3>\n\n\n\n

For Osiris-enabled deployments, Osiris automatically instruments application pods. When Osiris determines that a deployment’s pods are idle, Osiris scales the deployment to zero replicas.<\/p>\n\n\n\n

Once an Osiris-enabled deployment is scaled to zero, Osiris injects service endpoints that wait for that service to receive traffic. If traffic is destined for that service, Osiris will scale the deployment back up to the minimum number of replicas and forward the request.<\/p>\n\n\n\n

How does this affect autoscaling?<\/h3>\n\n\n\n

Osiris can be used to realize the full potential of Virtual Kubelet powered workloads by providing a lightweight infrastructure to enable workloads to scale to zero. When coupled with micro-billed container platforms this means that you will only have to pay for your services when they have traffic to process.<\/p>\n\n\n\n

Osiris is designed to work alongside the Kubernetes Horizontal Pod Autoscaler and it is not meant to replace it. Osiris will simply scale your deployment down to zero and back to the minimum number of replicas. All other scaling decisions may be delegated to an HPA, if desired.<\/p>\n\n\n

\"Diagram<\/figure>\n\n\n\n

How do I get connected?<\/h3>\n\n\n\n

Looking to learn more about Osiris? Please visit the Osiris Github repository<\/a> to learn how to get Osiris setup on your cluster today. We are eager to hear your opinions on the concept of scaling to zero in Kubernetes.<\/p>\n\n\n\n

Answering Kubernetes workload compliance<\/h2>\n\n\n\n

Throughout our journey enabling users to move their workloads to Kubernetes we\u2019ve frequently been asked, \u201cHow do we make sure Kubernetes resources conform to our internal policies and procedures?\u201d Every organization has its rules, whether it be that each resource needs to be labelled a specific way or to only use images from specific container repositories. Some of these rules or policies are essential to meet governance or legal requirements, and may be based on learning from past experiences.<\/p>\n\n\n\n

These policies need to be enforced in an automated fashion, at create time, to ensure compliance. Resources that are policy-enabled make the organization agile and are essential for long-term success as they are more adaptable. With automated policies, violations and conflicts can be discovered consistently, as they are not prone to human error.<\/p>\n\n\n\n

Introducing Kubernetes Policy Controller<\/h3>\n\n\n\n

Kubernetes Policy Controller<\/a> allows enforcement of custom semantic rules on objects during create, update, and delete operations without recompiling or reconfiguring the Kubernetes API server. The controller is backed by the Open Policy Agent (OPA), which is a lightweight, general-purpose policy engine for cloud-native environments.<\/p>\n\n\n\n

How it works<\/h3>\n\n\n\n

The Kubernetes Policy Controller is a mutating and a validating webhook that gets called for matching Kubernetes API server requests by the admission controller, allowing cluster operators to easily enable and enforce policies for their clusters. The Kubernetes Policy Controller has two modes of operation:<\/p>\n\n\n\n