Controlled Mayhem With Cloud Native Security Pipelines
summary
Cloud-native pipelines shift risk into orchestration and cloud layers and the concrete points matter: GitOps and GitOps workflows drive deployments, Spinnaker and Jenkins X plugins run on Kubernetes, namespaces and service accounts map to IAM roles, canary deployments enable automatic rollback, and Helm/Tiller plus default Kubernetes settings often leave clusters and S3 buckets exposed or logs disabled. Secrets in k8s ETCD are often plaintext so Vault or platform-managed IAM and STS with short-lived credentials are recommended. A Jenkins X extension runs security scans in ephemeral preview namespaces.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:25Jack Mannino
- 1:37The Traditional CI/CD Pipeline
- 2:35Cloud Native CI/CD Pipeline
- 3:26Old School vs. New School
- 6:18Focus on Fundamentals First
- 7:01Spinnaker
- 8:06Gleaning Knowledge via Testing
- 12:14Security Challenges & Opportunities
- 13:53Failure is Everywhere
- 16:07Container & Orchestration Systems
- 22:19Access Control for Subjects
- 24:42AWS EKS Insecure Defaults
- 26:01Helm, Tiller, and Problems
- 26:51Don't Do Dumb Stuff
- 31:08Building Jenkins X Extensions
related talks
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
26mEverything You Should Be Doing, But Aren’t: DevSecOps for K8s Workflows
34mContinuous Security - Integrating Pipeline Security
35mBuilding Reusable DevSecOps Pipelines on a Secure Kubernetes Platform- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
41mCloud Native Security For The Rest Of Us
45mSecure All the Things: From IaC to Kubernetes
40mAre your CI/CD Pipelines Secure?