Real Security for Services on Kubernetes [I]
summary
Databricks builds a system called Genie that issues time-boxed TLS certs (employee certs signed by an internal CA) after Google group SSO and Vault issuance, binds groups to namespace-scoped ClusterRoleEdit role bindings, and enforces impersonation and CI access via Vault-issued tokens. Secrets use vault-backed secret templates that generate Kubernetes Secrets on apply, and audit combines Genie logs with Kubernetes API server audit trails. Production certificates are intentionally short‑lived — 16-minute prod certs — and the system is deployed and in active use.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:33What is Databricks?
- 3:06How does Databricks work?
- 4:11Databricks Security Concerns
- 6:27How do we do Access Control?
- 8:59What Just Happened? Genie
- 10:01Employee Certificate
- 10:41CA Trust Chain
- 11:22Kubernetes Auth Strategies
- 13:10Kubernetes Role Bindings
- 15:31Permission Impersonation
- 17:03Continuous Deployment
- 18:42Hashicorp Vault
- 20:05Secrets in your k8s Deployments
- 21:04Secret Templates
- 23:02Auditing & Logging
- 24:11Take aways
related talks
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
30mHow to Make Kubernetes Secrets Really… Secret?
46mSecuring Secrets in the GitOps era
30mLook Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap
24mOne stop talk for kubernetes security !!
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
43mSecuring Secrets in the GitOps Era
39mManaging and securing Kubernetes secrets - Simon Pearce