Integrating Cloud Native Security into the SRE culture
summary
Argument: SRE practices map directly to security needs, demonstrated by installing the Trivy operator via Helm into a Kubernetes test cluster, wiring its metrics into Prometheus and Grafana, and deploying apps with Argo CD and k9s for inspection. The operator auto-scans container images and writes vulnerability reports, metrics expose alertable counts, and dashboards show 8 vulnerabilities (1 critical, 4 high, 1 medium, 2 unknown) so filtering for only fixable issues reduces noise and enables actionable automation.
AI-written summary · about
chapters (8)
- 0:00Introduction to talk
- 3:12SRE culture and goals
- 9:29Security integration principles
- 14:46Choosing security tools
- 20:27Demo setup and Trivy operator
- 26:49Vulnerability scanning demo
- 29:41Visualizing security metrics
- 30:43Key takeaways and conclusion
related talks
30mIntegrating cloud native security into the SRE culture
34mIntegrating Cloud Native Security into the SRE culture
35mRole of SRE in DevSecOps
33mSecurity and SRE: Natural Force Multipliers
32mClimbing high — getting started with cloud native security through open source
25mHow do we help enterprise to adopt SRE and DevSecOps practices?
39mPragmatic Security for SRE
42mHow REI built a DevSecOps culture from the start