Kubernetes Multitenancy in Image Pulling
summary
Kubernetes adds an alpha kubelet feature that records image pull intent and final image pulled records on-disk, storing CRI image refs and credential hashes so node-local images get authorized without hitting registries on every pull. New kubelet fields include imagePoolCredentialsVerificationPolicy and preloaded images verification allow list, letting admins whitelist preloaded images. The built cache persists pulling and pulled records; a demo shows the new config blocks unauthorized reuse while the old behavior permits it.
AI-written summary · about
chapters (12)
- 0:00Kubernetes multitenancy intro
- 1:08Image pull security horror story
- 5:04Mitigation with admission controllers
- 6:32Problem space and design goals
- 7:35Image pull process explained
- 9:22Image pull cache intro
- 12:14Preloaded images use cases
- 15:09Proposed solution explained
- 18:01Cache record structure
- 22:59Live demo new behavior
- 25:51Demo results and security
- 26:12Closing and resources
related talks
24mReenforce Kubernetes Image Isolation in Multi-Tenant Service
30mEstablishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
30mSecuring Kubernetes Multi-Tenancy
31mStrengthening Auth in Kubernetes: Image Pulling, DRA Admin Access & Pod Certificates
35mThe Growing Need for Caching Container Images in Kubernetes
37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future Directions
48mImproving Container Image Registry Availability with Kube Image Keeper
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility