Keynote: Securing Kubernetes, the Upstream Way
summary
Kubernetes upstream security focuses on fixes that scale: SIG Security formed in 2020 after a 2019 third‑party audit (37 findings) and drove a KEP that integrates a taint‑propagation static analyzer golow Levy into the Prow CI to block PRs that log secrets via klog. The 2023 audit finds 19 issues including six medium‑risk privilege‑escalations: client CA/request‑header CA overlap, a now‑patched path traversal namespace specifier, API‑server proxy redirection needing specific get/create/patch rights, and node‑proxy execs reported by Aqua and NCC Group.
AI-written summary · about
chapters (7)
- 0:00Kubernetes security intro
- 0:42SIG Security and sub-projects
- 2:09Security docs and tools
- 3:34Third-party audit findings
- 5:20Privilege escalation vulns
- 8:31Kubernetes security future
- 9:56Acknowledgments
related talks
06mKeynote: Future-Proofing Kubernetes
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
22mSecurity Through Transparency: Kubernetes SIG Security Update
11mSecuring the Kubernetes Ecosystem
04mKeynote: How Developers Help Scale Kubernetes Security
19mHow to Secure Your Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
33mKubernetes Security: Horror Stories to Help Secure Your Cluster