Effective building blocks for securing...
summary
Snap moves from cluster‑per‑service to shared Kubernetes clusters across AWS and GCP by building an opinionated service mesh with Envoy sidecars, a custom admission controller enforcing Pod Security Standards and image signature checks, per‑service identities via workload identity federation, auto‑upgrading node pools, and a zero‑trust proxy for kube API access. Deployments go through a golden CI/CD path, logs sink to service‑owned projects, and initial rollout starts with tier‑2+ services then dogfoods tier‑0 to prove it works.
AI-written summary · about
chapters (9)
- 0:00Introduction to platform security
- 1:04Evolution of Snap’s platform
- 8:53Security risks in multi-tenancy
- 13:48Identity and access controls
- 15:53Hardening production access
- 19:45Recap of security controls
- 23:18Challenges and migration lessons
- 27:59Future platform vision
- 29:04Q&A session
related talks
37mAchieving High Security at Scale with Microservices
46mAdvanced Kubernetes: Lesson Learned From Building..
37mKubernetes Security and How to Fix K8s Cluster at Scale
28mKubernetes Security Low-Hanging Fruit
35mCloud Native Security for the Rest of Us
24mOne stop talk for kubernetes security !!
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]
32mService Networking Within Air-Gapped Environments: Deployment Strategies and Operat...