Securing Helm 3
summary
Helm 3 is a CLI-only client (demo runs on minikube with helm v3.0.0-beta3) that removes Tiller and relies on Kubernetes RBAC and TLS user certs for auth; the demo scripts create users (Sam, bacon gobbler), namespaces, and role/clusterrole bindings to show installs failing without permissions and succeeding after granting edit or cluster-admin scopes. Helm stores release metadata as secrets so a secret-reader clusterrole is required for helm list/status and cross-namespace viewing.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:34Matt Fisher
- 0:52Agenda
- 4:25User Management
- 5:31Tls Certificates
- 6:32Role Based Access Control
- 7:01Auditing against a Kubernetes Cluster
- 7:58Cluster Admin
- 8:41View Access
- 9:25View Cluster Role
- 10:07Secret Reader Cluster Role
- 10:30Edit Cluster Role
- 12:21Rewrite Access
- 13:14Demo
- 15:33Create a User
- 25:06Why Do We Use Secrets
related talks
37mHacking Helm
12mLightning Talk: Helm and the Sigstore Ecosystem
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
32mStop giving root access and start securing your Kubernetes clusters instead
33mSecuring Kubernetes in the Cloud
31mFast & Secure: Package, Sign, Verify, and Deploy
32mStrengthening Kubernetes Security
08mKubernetes Secret Management The Right Way With Vault