Towards a World Without Dependency Consideration: All Resources Be...
summary
Proposal introduces KEP-2839 Lien to block deletions by adding metadata locks but it stalls because of the per-field authorization gap in CAP3617 permission model. Practical alternative is Crossplane usage (alpha): an admission webhook that rejects delete requests for Crossplane-managed S3 buckets and prevents deletion ordering mistakes (demo shows S3 bucket blocked while a DynamoDB-like table remains). Limitation: protection applies only to Crossplane-managed resources.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:05World without dependency consideration
- 7:16Dependency consideration in Kubernetes
- 10:51Resource protection with Reen field
- 13:03Reen field permission challenges
- 15:09Crossplane as alternative
- 18:37Crossplane Usage feature
- 20:00Demo preventing deletion
- 22:57Demo deletion ordering
- 26:55Issues and solutions
- 28:26Q&A
related talks
34mHow To Fight Misconfiguration And Bad Intentions
37mGuardians of Multi-Tenancy: Enhanced Authorization To Prevent Lateral Node Escape
27mk8s Validating Admission Policy And Crossplane - Viktor Farcic
38mMulti-Tenancy WG Deep Dive
33mImplementing Anti-patterns: Kubernetes Cross-namespace Resource Ownership
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security
30mKubernetes Data Protection WG Deep Dive
34mPrinciple of Least Privilege: How to Secure Kubernetes Without Making Users Hate You