Hardening Multi-Cloud Kubernetes Clusters as a Service
summary
SAP and Kinvolk present a cluster-as-a-service that provisions seed control-plane clusters and per-tenant worker clusters across multiple cloud providers, with automation, monitoring and ticketing. They analyze security failures from misconfigured cloud provider interfaces and metadata access—showing cloud-controller-manager and exposed APIs can grant far more privileges than intended—and demonstrate hardening steps such as Calico networking, kube-proxy tuning, certificate and proxy isolation, behavioral monitoring and selective lockdown, noting these measures reduce risk at the cost of flexibility and rollout speed.
AI-written summary · about
chapters (10)
- 0:00Multi-cloud Kubernetes hardening
- 3:51Managed clusters automation
- 7:17Networking and control plane security
- 10:20Multi-tenancy risks
- 14:09Cloud provider security gaps
- 17:33Certificate and proxy security
- 20:36Privilege escalation risks
- 24:34Security tools and analysis
- 27:40Real-world security use cases
- 29:35Conclusion
related talks
24mSelf-Service Multi-Cloud K8s Platform at a Regulated Financial Enterprise
37mKubernetes Security and How to Fix K8s Cluster at Scale
36mThe Architecture of a Multi-Cloud Environment with Kubernetes
53mFlying Above the Clouds: Securing Kubernetes
26mMulti-layer hardening in Kubernetes
38mBuilding for Trust: How to Secure Your Kubernetes Cluster
41mAn Adventure in Multi-Cloud with Kubernetes
22mSecuring Kubernetes