~/talk

KubeVirt: privilege dropping one capability at a time

Talkat FOSDEM 2021 · on Saturday, 2021-02-06· at 10:45· D.virtualization· [kubernetes, security]

speaker

name:Miguel Duarte Barroso

links:none on file

resources

video:https://video.fosdem.org/2021/D.virtualization/vai_kubevirt_privilege.mp4

slides:https://fosdem.org/2021/schedule/event/vai_kubevirt_privilege/attachments/slides/4540/export/events/attachments/vai_kubevirt_privilege/slides/4540/kubevirt_privilege_dropping.pdf

summary

Explains how KubeVirt reduced privileges for the untrusted virt-launcher pod by iteratively removing Linux capabilities, specifically CAP_NET_ADMIN and CAP_NET_RAW. Covers concrete engineering changes made in KubeVirt and libvirt and discusses the networking implications (DHCP and layer‑2 networking) that required those changes.

AI-written summary · about

related talks