Data Security: Theoretical and Real World Approache...
summary
Rook Ceph operator automates packaging, cluster management, scaling and self‑healing for Ceph on Kubernetes and supports encrypted OSDs with LUKS, external KMS via HashiCorp Vault (added in Nautilus/1.5) and a v2 messenger protocol that adds on‑the‑wire encryption with a CRC default and a stronger “secure” mode set at cluster creation; most security toggles still require manual CRD edits. Formal methods and memory‑safe languages (Go/Rust) are proposed to eliminate classes of CVEs—21% were memory overflows in 2019, access control ~1% under CWE‑284 in 2020—though full proofs remain costly.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:30Outline
- 1:02Overview
- 2:20Why Kubernetes
- 3:22Rook
- 10:19Sources
- 10:34Access Control
- 11:18Buffer Overflow
- 11:44Go and Rust
- 12:42Enforce Security
- 13:18Impossible to Mess Up
- 13:48Denial
- 14:17Formal Methods
- 17:30Abstractions
- 18:36Programmers Mental Model
- 19:42Verification
- 23:08Development Philosophy
- 24:08Noninterference
- 27:46Using formal methods
related talks
35mData Security and Storage Hardening in Rook and Ceph
36mCeph Security BoF
13mEncrypting Your Way to Safety: Data Security in Kubernetes
27mEncrypting Data in Ceph: An Overview and Opportunities
24mSecurity Process Improvements in Ceph and Rook
24mOne stop talk for kubernetes security !!
22mSecuring Kubernetes
35mCloud Native Security for the Rest of Us