Fine grain access control for Kubernetes
summary
The slide claims a working SpiceDB Kubernetes API Proxy that integrates SpiceDB (Zanzibar model) to enforce relationship‑based permissions, including deny rules and expirations, and it demoed real‑time schema and relationship changes that immediately affect access. The proxy implements the Kubernetes API in Go, works with kubectl and CRDs, uses SpiceDB’s lookup resources to support listing and filtering (not just yes/no checks), is open source, runs in‑cluster, and requires a separate HA service that can be bypassed if needed.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 1:48Kubernetes auth methods
- 8:49Introducing SpiceDB and relationship-based access control
- 13:21SpiceDB proxy benefits
- 24:24Fine-grain access control Q&A
related talks
35mSpiceDB: open source, hyperscale authorization
01h 01mSpiceDB: Flexible Permissions Database for the Internet Era
16mAccess Granted with AuthZed
59mKubernetes access control in the enterprise
33mHow to Prevent AI Agents from Accessing Unauthorized Data
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles
34mKubernetes in Highly Restrictive Environments
24mOne stop talk for kubernetes security !!