Knative - The Security Platypus?
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 17:20· Pacific Ballroom, Salon 20-22 - Marriott Marquis San Diego Marina Hotel·
summary
Knative extends Kubernetes to run event-driven containers but inherits a different threat model than Lambda: a live demo uses the OWASP serverless vuln on AWS to perform code-injection via URL parameter and extract access key secret key and session token from environment variables, then read DynamoDB. Mitigations shown include image scanning, Kubernetes RBAC, network policies and Istio mTLS and RBAC for event auth, at the cost of added cold-start and complexity.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:53What services
- 4:45Knative recap
- 8:12Security Platypus
- 11:36Security Frameworks
- 13:52Public Clouds
- 14:04Syndication
- 15:01Demo
- 22:59Security Assumption
- 24:09Vulnerabilities
- 25:29Cloud Infrastructure
- 26:19Container Security
- 27:02Knative Security
- 27:17Potential Pitfalls
- 28:17Easter
- 30:25Conclusion
- 31:10Evan Anderson
related talks
20mKnative: A Kubernetes Framework to manage Serverless Workloads
31mKnative: Is it for me?
29mKnative - deploy, and manage modern container-based serverless workloads
37mKubernetes to Cloud Attack Vectors: Demos Inside
30mKnative goes beyond serverless
31mKnative, the Serverless That Isn't Serverless
35mStop Calling Knative Serverless!
35mKnative: More Than Just Serverless Cont...