~/talk

Sharing is Caring: Your Kubernetes Cluster, Namespaces, and You

on YouTube 35m
Talkat KubeCon + CloudNativeCon Europe 2019 · on Thursday, 2019-05-23· at 14:50· Hall 8.0 A1· [security, policy-and-regulation, kubernetes]

speakers

name:Amy Chen
github:amy
name:Eryn Muetzel
links:none on file

resources

video:https://youtu.be/_VNv7jBh1XA
slides:none on file

summary

Covers concrete namespace patterns (per-team, per-application, per-environment), risks like an accidental creation of 80,000 namespaces, and measurable controls: RBAC roles (admin/edit/view), ResourceQuota limits, PodSecurityPolicy and NetworkPolicy enforcement, and image whitelist. Recommends admission controllers for enforcement and using Open Policy Agent to push consistent policies across cluster groups, plus label-based cluster/namespace groupings and automated templates so namespaces are created with PodSecurityPolicy and quotas applied.

AI-written summary · about

chapters (13)

  1. 0:00Intro
  2. 1:27NAMESPACES VS. CLUSTERS
  3. 3:51USE CASE 1: ONE TEAM PER CLUSTER
  4. 5:23USE CASE 2: SHARED CLUSTERS
  5. 7:41WHAT DO YOU NEED TO CREATE VIRTUAL CLUSTERS ?
  6. 11:58COMMON APPROACHES
  7. 14:15INFRASTRUCTURE (CLUSTER) VS. APP (NAMESPACE)
  8. 16:44SECURITY BOUNDARIES
  9. 23:21QUOTA ENFORCEMENT
  10. 25:34HOW? ADMISSION CONTROLLERS
  11. 28:15PEOPLE ARE... MESSY
  12. 29:42CONFLICTING NEEDS
  13. 32:13HOW OPEN POLICY AGENT (OPA)

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.