Achieving High Security at Scale with Microservices
summary
Claims a production Kubernetes stack meets finance-grade security by enforcing dockerfile/CVE policies, using Notary-signed base images and content trust, and automating scans with CoreOS Clair, OWASP Dependency Checker and DAGDA in CI. Build pipeline squashes images, pins external downloads, runs OWASP ZAP “continuous hacking,” and rejects unsigned images via admission controllers (Portieris). Cluster controls include RBAC, audit logging, pod security/network policies and scheduling isolation. Implementation is incremental but operational at Ygrene and catches real CVEs before deployment.
AI-written summary · about
chapters (7)
- 0:00Start
- 21:28Security Testing
- 23:45The Identity Policy
- 31:41Mitigations
- 32:01Role-Based Access Control
- 32:25Api Server Admission Controllers
- 34:58External Tools
related talks
46mA Security State of Mind: Continuous Security with Kubernetes
11mSecuring the Kubernetes Ecosystem
22mSecuring Kubernetes
19mHow to Secure Your Kubernetes Clusters
33mKubernetes Security Jumpstart
35mCloud Native Security for the Rest of Us
41mKubernetes Security Jumpstart
46mContinuous Kubernetes Security