Securing Kubernetes Multi-Tenancy
summary
A Red Hat survey result — over 60% delay deployments for security — motivates a demo-heavy walkthrough that ties code-to-cloud risk to concrete fixes. The session shows an observability platform that traces a vulnerable image back to a GitHub commit, finds it was signed with a cosign signature yet still contained CVEs, and demonstrates an S3 exfiltration path via a pod with automountServiceAccountToken=true and laterally moving because a pod used hostNetwork=true. Countermeasures shown: Cilium/Calico network policies, OPA Gatekeeper admission policies, image scanning (Chainguard) and provenance checks.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:48What is multi-tenancy
- 3:56Security risks in clusters
- 6:23Classifying risks
- 7:27Identity risks and attacks
- 10:19Detecting privilege escalation
- 12:57Supply chain risks
- 15:48Tracing vulnerabilities
- 19:25Network risks and movement
- 23:18Data exfiltration demo
- 25:05Runtime and storage risks
- 26:31End-to-end security framework
- 29:19Q&A
related talks
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
43mKubernetes Security: Attacking and Defending Modern Infrastructure
01h 37mLines of Defence – Securing Your Kubernetes Clusters
35mKubernetes Security - Challenge and Opportunity?
46mContinuous Kubernetes Security
11mSecuring the Kubernetes Ecosystem
22mSecuring Kubernetes
33mSecuring Kubernetes in the Cloud