Mesos Security Exposed!
summary
Adds signed JWT tokens (HMAC-SHA256) to authenticate executors (payload: frameworkID, executorID, containerID) so fake executors can no longer claim IDs; requires HTTP v1 executor API and an executor secret. Introduces environment and volume secret isolators plus a secret resolver interface and Docker image credential support to mount secrets into tasks (volume isolator disabled by default). Enables ECDHE support for smaller keys and introduces hierarchical roles with reservation refinement for multi‑tenancy.
AI-written summary · about
chapters (15)
- 0:00Start
- 2:17Security Basics
- 6:26Public Agents in Dcos
- 18:13Custom Modules and Hooks
- 20:00Http Authenticators
- 21:18Executor Authentication
- 26:38What Is the Secret
- 28:22Secret Resolver
- 29:59Database Credentials
- 32:12Enable the Volume Secret Isolator
- 39:01Multi-Tenancy Concerns
- 40:03Hierarchical Roles
- 41:53Reservation Refinement
- 43:35Authorization Name Spacing
- 44:20Secret Namespacing
related talks
38mKeeping Secrets - A Practical Approach to Managing Credentials
36mSIG Auth Deep Dive
18mA Secure Tekton Task by Using Confidential Containers
30mTrust No One: Secure Storage With Confidential Containers
43mSecure your Modular Monolith by pretending it's a cat
20mApplication Secret Management with AWS KMS
38mBootstrapping Secure Mesos Clusters
48mThe Hacker's Guide to JWT Security