Good Fences Make Good Neighbors: Making Cross-Namespace References More Secure with Re...
summary
Kubernetes needs an explicit two-way handshake for safe cross-namespace references: the owner of the target object must create a ReferenceGrant in the same namespace and the referencer must explicitly request the reference. Controllers implementers must watch ReferenceGrant objects, typically run with broad read access, and revoke access when grants are removed (revocation on deletion). Gateway API already uses this for Gateways and HTTPRoutes, storage uses it for cross-namespace PVC snapshots, and the CAP for moving ReferenceGrant toward core is provisionally merged.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:25Cross-namespace references need security
- 5:15TLS delegation in Contour
- 7:00Gateway API design
- 10:10Introducing ReferenceGrant
- 12:18ReferenceGrant goals
- 15:25Implementation challenges
- 18:36ReferenceGrant in Kubernetes
- 22:45Key takeaways
- 27:56Q&A
- 30:02ReferenceGrant CAP proposal
- 34:12API design challenges
- 37:45Summary
related talks
33mImplementing Anti-patterns: Kubernetes Cross-namespace Resource Ownership
36mGateway API The new way to travel north south
35mSharing is Caring: Your Kubernetes Cluster, Namespaces, and You
34mFine-Grained Permissions in K8s: What’s Missing, and How to Fix That
27mProviding secure Ingress into a multi-tenanted cluster using GatewayAPI
35mGateway API: The Illustrated Guide to the Future of Kubernetes Networking
47mGatewayAPI, 10 Years of Maturation for a New Kubernetes API
01h 00mGateway API: Basics, Nuance, and the Real World