Spinnaker Deployments on Kubernetes from a Security Perspective
summary
Deploys Spinnaker to EKS with private worker nodes and public ALBs, separates management and application nodes, and runs Spinnaker in its own namespace; recommends Calico network policies to block cross-namespace access except needed services (Jenkins on 8084), enforces SSL on ALBs, locks Spinnaker data in S3 with bucket encryption and IAM instance profiles, avoids cluster-admin service accounts by creating granular Kubernetes RBAC and Spinnaker service accounts (via fiat), and enables GitHub org authentication, authorization groups, and audit logging to make exploitation much harder.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:08Overview
- 4:23Cluster Roles
- 6:16Network Policies
- 7:59S3 Bucket
- 9:56Console API
- 13:29Authorization Workflow
- 15:24Kubernetes Service Account
- 18:00Conclusion
related talks
08mAutomated & Immutable Spinnaker Deployments with Security...
22mPro Tips: Use Spinnaker when Kubernetes multi-tenancy is a nightmare
23mBuild a Spinnaker pipeline in highly regulated bank environment
45mGetting Started with Spinnaker (part 1)
29mGetting Started with the Spinnaker Operator and Amazon EKS
19mDo's and Don'ts for Securing and Governing your Spinnaker Environment
32mReducing Deployment Risks with Progressive Automated Canary and Spinnaker in a Reg...
30mSecrets Management with Spinnaker