~/talk

Kubernetes Security and How to Fix K8s Cluster at Scale

on YouTube 37m
Talkat KubeCon + CloudNativeCon Europe 2019 · on Tuesday, 2019-05-21· at 11:05· Hall 8.0 B3· [security, kubernetes]

speakers

name:Simon Pearce
links:none on file
name:Sebastian Scheele
links:none on file

resources

video:https://youtu.be/5dWRh301Lno
slides:none on file

summary

Managed service runs hundreds of public API Kubernetes clusters across OpenStack and AWS and automates security and upgrades: centralized inventory + dashboard shows vulnerable versions, a change advisory board triages CVEs (example: December API proxy escalation), CI with cross-cloud e2e and conformance tests validates upgrades, and clusters run as k8s resources so cluster API and machine deployments enable orchestrated rolling upgrades. Enforced PodSecurityPolicies and admission controllers block root containers; kube-bench and targeted canary patches reduce blast radius.

AI-written summary · about

chapters (39)

  1. 0:00Intro
  2. 1:29Service Provider
  3. 1:41On OpenStack and AWS
  4. 2:03Managed Clusters
  5. 2:54Service Level Agreement
  6. 3:15K8s API Servers Public
  7. 3:41Motivation?
  8. 3:51Managed Service
  9. 4:07Security incidents
  10. 4:26Runc CVE-2019-5736
  11. 5:26Attackers overwrite the RunC Binary and obtain host root access
  12. 6:53The Challenge
  13. 7:07Hundreds of Clusters
  14. 7:24Multiple Clouds
  15. 7:47Dealing with Security issues
  16. 8:04Upgrading Production Clusters
  17. 8:43Build an Operator for Kubernetes
  18. 9:19Use the Cluster API as building block
  19. 10:21Cluster Creation
  20. 11:26Cluster Configuration and Management
  21. 12:06Machine Deployment Object
  22. 12:41Run Kubernetes in Kubernetes
  23. 13:27Monitoring
  24. 15:11Patch Cluster Object
  25. 16:00What is effected?
  26. 16:12How severe is the impact?
  27. 16:44Change Advisory Board
  28. 18:29Roll out new base image
  29. 18:51Upgrade Machine Deployments
  30. 19:38Rolling Upgrade
  31. 19:48Upgrade Docker Daemon
  32. 20:37Best Practices
  33. 20:51Automate all Upgrade Processes
  34. 21:32E2E Tests on all Supported Clouds
  35. 23:11k8s Conformance Tests
  36. 24:03Pod Security Policies
  37. 25:02K8s Admission Controllers
  38. 25:22Check CIS Benchmark
  39. 26:00Kubernetes Security Announcements

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.