Surviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 11:00· Level 1 | Hall Entrance N10 | Room F·
summary
CNCF security landscape lists about 80 projects and keeps growing; expect concrete tactics not platitudes. Image scanning uses Trivy to extract layers, build a filesystem and report specific package CVEs (demo shows three package vulnerabilities). Admission controls use Kyverno to mutate (add limits) and validate (block noncompliant namespaces). Secrets sync uses External Secrets with AWS Secrets Manager and IAM role for rotation/versioning. Runtime uses Falco with eBPF to turn syscall noise into alerts (exec-in-container, unexpected writes), catching issues image or policy scans miss.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:29Speakers and overview
- 2:32CNCF security projects
- 4:00Container image scanning myths
- 6:32Scanning images for vulnerabilities
- 8:41Build phase and raccoon analogy
- 9:04Deploy phase and admission controllers
- 10:10Caveat as admission controller
- 12:57Forest guard analogy for Caveat
- 13:38Start phase and Kubernetes secrets limits
- 15:45External Secrets Operator
- 17:09External Secrets Operator analogy
- 17:54Runtime phase and container observation challenges
- 19:21Falco and eBPF for runtime security
- 21:27Why runtime security matters
- 22:53Ingress security case study
- 23:33Key takeaways
- 24:57Beginner-friendly security resources
- 25:39Closing and feedback
related talks
22mSecuring Kubernetes
32mStrengthening Kubernetes Security
26mMulti-layer hardening in Kubernetes
30mA secure journey on Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
43m6 Strategies to Bring Order to Kubernetes Security Disruptions
38mFrom Risks to Resilience: Leveraging CNCF Projects Against Kube...
19mKubernetes Security: Navigating the Real-World Challenges