Pod Security as an Afterthought
Talkat Cloud Native Security Day Europe 2020 · on Monday, 2020-08-17· at 16:40· InXpo, https://onlinexperiences.com/Launch/Event.htm?ShowKey=99259·
summary
Three open source tools automate pod-hardening by observing live behavior and emitting policies: kube-psp-advisor parses manifests and cluster API to generate one PSP per namespace/serviceAccount (it mirrors requested capabilities and volumes, not actual syscall use); oci-seccomp-bpf-hook installs an eBPF tracer per container and writes seccomp JSON by logging syscalls on exercised code paths; Inspektor Gadget network policy advisor logs TCP connect/accept events via BPF and converts them to NetworkPolicy rules. All outputs require human review because coverage depends on exercised paths.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 1:02What is pod security
- 2:28DevOps lifecycle and security
- 3:31Security as an afterthought
- 4:37Generating policies from behavior
- 5:40PSP Advisor for pod policies
- 8:52OCI Second BPF Hook for seccomp
- 13:28Network Policy Advisor with Inspector Gadget
- 18:25Q&A session
related talks
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
41mUsing Pod Security Policies to harden your Kubernetes cluster
40mKubernetes Security After Pod Security Policies Removal
37mHandsOn PodSecurity Policies
35mPSP is Dead, Long Live PodSecurity
36mKubernetes Security After Pod Security Policies Removal
12mTalk Deep Dive
31mAutomatic application hardening by leveraging container runtime behavior analysis