k-rail: A Tool to Manage K8s Securely at Speed
summary
k-rail enforces pod-level rules via a validating/mutating webhook to block risky configs (no bind mounts, no privileged containers, no hostNetwork, image hash pinning) and ships telemetry plus exemption support. Policies are implemented as policies in Go and k-rail runs in monitor mode before flipping to enforcement. Deployment across production clusters (one snapshot had 18,000 pods) reaches full enforcement in about a week with near-zero developer impact, and exploits that rely on host networking or docker sockets are prevented.
AI-written summary · about
chapters (15)
- 0:00Introduction and setup
- 1:46Kubernetes basics for all
- 3:09Threat model and risks
- 5:16Common k8s security issues
- 7:02Live attack demonstrations
- 9:29Solving the security problem
- 11:54Introducing k-rail
- 13:21Policy enforcement demo
- 14:03Built-in security policies
- 16:33Additional policies explained
- 18:41Writing custom policies
- 20:06k-rail in action
- 20:48Real-world deployment data
- 21:51Impact on engineering teams
- 22:57Open source and Q&A
related talks
41mKubernetes Security Jumpstart
32mOperating Rails in Kubernetes
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
28mClosing the Loop: Applying Least Privilege and Ensuring We Did It Well
24mOne stop talk for kubernetes security !!
30mA secure journey on Kubernetes
29mCompliance in Kubernetes: Enforcing and Visualizing
46mContinuous Kubernetes Security