Write blurb on using OPA as an alternative to PSPs about aws-eks-best-practices

[jicowan]

Thanks for the feedback @joebowbeer. You have roughly 2 years to decide. Until then, you can continue using PSPs or, once it emerges from alpha, you can use the PSP Replacement (presently, EKS only supports beta and GA features). If you have complex policy requirements you may want to consider using OPA, e.g. if you need to validate elements of the pod specification outside of securityContext. Here is a brief but good discussion on the deprecation of PSP, https://youtu.be/2G09tl9Gx_Q?t=638.

[mhausenblas]

We should also include Gatekeeper's support for PSP here.

[joebowbeer]

@jicowan Currently, OPA Gatekeeper is only mentioned in two links in a Tools and Resources section at the bottom of the page. Is this adequate guidance? (I ask this naively not rhetorically.)

Given that PSP is deprecated, I'm trying to determine what the best practice should be regarding pod security. Can you discuss the decision of whether to replace and/or augment PSP with Gatekeeper or Kyverno in the body of this section? I would appreciate it if you could recommend a course of action. Or are we to assume that we should stick with PSP for now, even if we are creating a new cluster?