How Kubernetes Components Communicate Securely in Your Cluster
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 11:50· Ballroom Sec 20CD - San Diego Convention Center, Upper Level·
summary
Explains exactly which Kubernetes pieces hold trust: the kube-apiserver, kubelet and etcd, and what is actually protected. Claims the apiserver→kubelet path is unauthenticated TLS by default while kubelet→apiserver uses mutual TLS, etcd peers use mTLS, and kubeadm can auto-generate certs. Notes the CertificateSigningRequest API (beta) for node bootstrapping, kubelet cert rotation defaults to one year, GKE manages rotation and offers shielded GKE nodes to protect bootstrap keys.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:54Kubernetes Components
- 4:01Communication Security
- 10:34Kubernetes CA
- 17:39Communication flows
- 25:07Summary
- 28:04CIS benchmarks
related talks
57mThe Kubernetes Sessions Security
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
38mBuilding for Trust: How to Secure Your Kubernetes Cluster
46mContinuous Kubernetes Security
29mKubernetes Security Best Practices
22mIdentity with certificates in Kubernetes
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences