Enhancing Kubernetes with the Security Profiles Operator

on YouTube ↗24m

" summary

Operator provides Kubernetes-native CRDs for seccomp and SELinux profiles, a daemonset that renders JSON profiles into the kubelet path, and a webhook that injects profile references into pod securityContext. It records seccomp syscalls using CRI‑O (>=1.21) plus the OCI seccomp BPF hook and generates per-pod or per-replica profiles (demo shows distinct profiles per replica). Project is SIG Node‑sponsored, two releases old, depends on cert‑manager today and plans metrics, AppArmor, and removing cert‑manager.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 0:25Agenda
3. 5:35Security Profiles Operator
4. 11:12Security Profiles Operator Deployment
5. 16:53Demonstration
6. 22:13Future plans

" related talks

• 32mSecuring Kubernetes Applications by Crafting Custom Seccomp ProfilesSascha Grunert · KubeCon + CloudNativeCon Europe 2022
• 42mImproving Containers Isolation in KubernetesCosmin Cojocar · ContainerCon @ Open Source Summit North America 2023
• 38mContainer Security, capabilities an seccomp profilesMario Vázquez, Alberto Losada Grande · ContainerDays 2022
• 40mUsing the EBPF Superpowers To Generate Kubernetes Security PoliciesMauricio Vásquez Bernal, Alban Crequy · KubeCon + CloudNativeCon North America 2022
• 20mGenerate seccomp profiles for containers using bpfDaniel Walsh, Valentin Rothberg, Divyansh Kamboj · DevConf.CZ 2020
• 30mPod Security as an AfterthoughtAlban Crequy · Cloud Native Security Day Europe 2020
• 26mSecure Containers Deployments: Time for RefreshAriel Shuper · ContainerCon @ Open Source Summit North America 2022
• 23mSecurity in a containerized worldJessica Frazelle · Paris Container Day 2017