Building Secure Kubernetes Clusters with Identity Management
summary
Claims building a secure Kubernetes cluster with identity first and shows it actually working: integrates a running cluster with OpenID Connect via OpenUnison, demonstrates short‑lived ID tokens and refresh token lifecycle, uses impersonation for managed clusters, turns API audit logs into policies with audit2rbac automation, automates namespace + RBAC provisioning, locks down the dashboard, and exercises pod security policies (noting PSP deprecation by 1.22); lab uses kubeadm/kube‑apiserver flags, kubectl, JWT inspection, and a 125 VM workshop deploy that completes successfully.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 3:00Agenda
- 4:21Whats not covered
- 5:25Host Level Authentication
- 8:14What is Identity Management
- 13:21OpenID Connect
- 17:40OpenID Connect downsides
- 21:16How OpenID Connect works
- 24:44Best practices
- 27:21Open Source
- 28:19Logging into Open Unison
- 34:54API Configuration Flags
- 39:34Get TLS Certificate
- 40:54Update API Server
- 42:39Update API Server flags
- 44:14Dashboard integration
- 45:34Step 5 Remove Kubernetes Control context
- 47:54Step 6 Use jwcio
- 52:29Real Life Scenario
- 56:54Crew Plugin
related talks
29mCompliance and Identity Management in Kubernetes
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
59mKubernetes access control in the enterprise
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
32mStop giving root access and start securing your Kubernetes clusters instead
43mSharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials