Binary Authorization in Kubernetes
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 10:55· Room 16AB - San Diego Convention Center, Mezzanine Level·
summary
Kritis enforces deploy‑time image policies in Kubernetes using Grafeas metadata and an admission webhook; Helm charts install a Grafeas server (in‑memory or Postgres storage) and Kritis, images are scanned by security tools and published as occurrences, and an nginx pod is allowed while a Jenkins image with six critical vulnerabilities is rejected at admission. Roadmap calls for more metadata kinds, a 1.0 Grafeas, high‑availability Kritis and GCP binary‑auth interoperability. Kritis Grafeas
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:18Agenda
- 2:15Reality
- 3:07Use Cases
- 4:02Two Projects
- 4:32How it works
- 5:51Example Create Policy
- 11:47Demo
- 16:16Roadmap
- 20:34Questions
- 23:10OPA
- 23:50Allow List
- 24:50Graph
- 26:30Text Policy
- 27:10Microservice Policy
- 28:55Other Cloud Providers
- 30:30GraphQL
- 32:10cronjob
- 33:55image signature animation
- 34:45ownership responsibility
related talks
30mSoftware Supply Chain Management with Grafeas and Kritis
28mKnow Your Kubernetes Deploys
37mAchieving High Security at Scale with Microservices
31mImage Provenance and Security in Kubernetes
41mKubernetes Security Jumpstart
38mTutorial: Building Security into Kubernetes Deployment Pipelines
20mTrust but Verify
40mFun with Continuous Compliance