Tweezering Kubernetes Resources: Operating on Operators
summary
Operators extend the Kubernetes API but often run with dangerous permissions: scanning every operator on operator hub finds ~90 use a dedicated namespace yet 84 declare cluster roles, 64% can read Secrets, ~70% can exec into pods and only ~10 drop Linux capabilities. The Operator SDK and OLM speed builds but can scaffold overly broad RBAC; a static analyzer called bad robot flags missing securityContexts, default/ kube-system deployments and cluster-admin-like roles. Auditing manifests, restricting watched namespaces and validating runtime behavior reduce risk.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:08Kubernetes Operators
- 13:19CNC Operator Security Advice
- 21:24What about other threats?
- 28:32Conclusion
related talks
21mOperators for Beginners
36mLessons learned writing 10+ Kubernetes Operators - Lars Francke and Jannik Heyl
42mKubernetes Operators: What are They and Why would You Need Them?
35mKubernetes made simpler - Using and developing Kubernetes Operators
28mSmooth Operator - A Rough Guide to Kubernetes Operators - Olive Power, VMware
43mLessons learned writing 10+ Kubernetes Operators
32mMinimalist Best Practices in Kubernetes Operators
31mKubernetes Operators within Reach of Any Developer