Securing Serverless Functions via Kubernetes Objects - Sebastien Goasguen, Bitnami
summary
Shows how kubeless CRDs deploy functions as real Kubernetes objects and leverages pod identity and AWS IAM via kube-iam to give each function cloud credentials, with a CLI that annotates pods for per-function roles. Demonstrates namespace isolation, propagated labels, and network policies to restrict ingress, default nonroot Pod security contexts plus optional gVisor/ Kata for host isolation, and a Falco + NATS demo that detects miners and successfully kills pods, proving the controls work end-to-end.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:33What type of Apps
- 5:53Serverless
- 8:01Security of Functions
- 9:37Maybe you prefer a picture
- 10:45RBAC
- 11:43Namespace
- 12:05Labels
- 13:30Security Context
- 14:23Non-root Runtime
- 14:57Isolate runtimes
- 15:41Security Account for functions
- 18:01Configure security defaults
- 18:46External Security
- 19:36External HTTP Trigger
- 21:26Kong and more in the future
- 23:16External Service Authentication
- 25:26API Gateway demo
- 36:02Conclusions
related talks
39mServerless on Kubernetes with Kubeless [A]
26mUnleashing the Power of Serverless Computing in Kubernetes with Knati...
35mServerless with Kubeless
21mKeynote: Kubernetes Serverless Present and Serverless Future
01h 00mServerless Madness on Kubernetes
39mBuilding Serverless Application Pipelines
57mThe Kubernetes Sessions Security
33mSecuring Kubernetes in the Cloud