Bootstrapping Secure Mesos Clusters
summary
Hands‑on lab boots a master and agent from the GitHub repo DCOs-labs/secure-mesos-workshop using Docker images and mesos 1.4 rc5, then flips flags to add TLS, authentication, and ACLs; shows certificate workflows (offline root CA, CFSSL intermediate), explains module hooks and the secrets resolver / isolators that inject secrets as files or env vars, recommends a DMZ with public/private agents and a service gateway proxy, and provides ready scripts like secure_cluster_start so the secured cluster actually runs.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:38MOTIVATION
- 4:15OUT OF SCOPE (MESOS-4936)
- 5:43SECURE THE PERIMETER: BUILDING BLOCKS
- 8:34SECURE THE PERIMETER: OPERATORS
- 8:58SECURE THE PERIMETER: FRAMEWORK DEVELOPERS/USERS
- 9:40SECURE THE PERIMETER: SERVICE USERS
- 10:23SECURE THE PERIMETER: OPTIONAL - SERVICE GATEWAYS
- 13:21TLS: MESOS CONFIGURATION contd.
- 14:09PKI: CERTIFICATE INFRASTRUCTURE
- 16:10TLS: CERTIFICATE GENERATION - CERTIFICATE AUTHORITY
- 17:16MODULES: OVERVIEW
- 18:33MODULES: TYPES
- 21:32AUTHENTICATION: OVERVIEW
- 23:06AUTHENTICATION CREDENTIALS, PRINCIPALS AND SECRETS
- 23:48AUTHORIZATION
- 25:23ORGANIZATION NAMESPACE
- 28:12ORG-SECRETS NAMESPACE ACCESS MAPPING (FLATTENED)
- 29:04SECRETS: SEQUENCE DIAGRAM
related talks
25mAdministering Multi Cluster Service Meshes Securely
01h 06mHands-on Workshop: Batten Down the Hatches! A Cluster Security Journey
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...
38mBuilding for Trust: How to Secure Your Kubernetes Cluster
46mContinuous Kubernetes Security
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]
43mDocker Security: Start your Container Journey Safely
33mKubernetes Security Jumpstart