Armoring Cloud Native Workloads With LSM Superpowers
Talkat KubeCon + CloudNativeCon North America 2022 · on Wednesday, 2022-10-26· at 11:55· Virtual Platform Only·
summary
KubeArmor converts declarative policies into kernel enforcement (AppArmor/SELinux labels and BPF bytecode) and uses eBPF for observability to enforce inline denials with contextual telemetry. Demo shows writes to /var/lib/mysql get blocked, only a designated process can read a specific service-account token, apt/apt-get executions are denied, and network access is restricted per process — all enforced immediately and logged with container ID, namespace and policy that caused the denial. KubeArmor and eBPF + LSM enforcement work end-to-end.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:39Cloud Native Security
- 3:47Peeking into the Container
- 5:16Async Enforcement
- 5:40Inline Enforcement
- 7:20Linux Security Modules
- 7:58Pod Security Context
- 11:32Demo Scenario
related talks
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
28mKubeArmor: Applying Security Policies with Practical Examples in K8S
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
25mProtecting Modern Workloads with eBPF superpowers
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
30mFinding Imposter Among Us: Container Edition
24mRuntime Security: Challenges & Solution Space
31mAutomatic application hardening by leveraging container runtime behavior analysis