~/talk

Hacking Helm

on YouTube 37m
Talkat KubeCon + CloudNativeCon Europe 2019 · on Wednesday, 2019-05-22· at 14:00· Hall 8.0 A1· [security, kubernetes]

speakers

name:Paul C Czarkowski
bluesky:paulczar.bsky.social
name:Scott Rigby
bluesky:r6by.bsky.social

resources

video:https://youtu.be/QL-OztkJ4V8
slides:none on file

summary

Explains concrete Helm v2 attacks and mitigations: demos show how a global Tiller service and its clusterIP let an unprivileged pod call Tiller, use helm get values to read stored overrides in configmaps, and escalate to cluster admin; fixes include deleting the service, tiller listens on localhost, per-namespace RBAC with install per-namespace tillers, TLS for Tiller, and network policies. Covers alternatives: helm get values leaks secrets risk, helm template/tillerless workflow, Open Policy Agent and Vault/bitnami-secret options, and notes Helm 3 removes Tiller.

AI-written summary · about

chapters (4)

  1. 0:00Start
  2. 5:33HELM CHART WORKFLOW
  3. 19:50WHAT IF I NEED HELM ACCESS FROM INSIDE MY CLUSTER?
  4. 22:18HELM INSTALL IS THE NEW CURL BASH

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.