Keynote: Sugar Ray.io on K8s: Shut the Door, Baby!
summary
Recent Internet scanning finds misconfigured Ray clusters with unauthenticated dashboard and jobs APIs exposed, allowing attackers to pickle malicious objects into the global object store and trigger remote execution on other nodes. Deployments using KubeRay on Kubernetes or GKE can instead use identity-aware proxies, Kubernetes API server auth, namespaces, network policies and resource quotas to limit blast radius and share scarce GPUs/TPUs; the presenters show concrete attack propagation vs Kubernetes containment.
AI-written summary · about
chapters (7)
- 0:00Welcome
- 2:53Ray on Kubernetes
- 3:34Ray security challenges
- 5:39Attack propagation
- 7:46Kubernetes security boundaries
- 9:31Kubernetes solutions for Ray
- 12:19AIML security future
related talks
19mKeynote: Hello From the Other Side: Dispatches From a Kubernetes Attacker
29mKubernetes Security: Attacking and Defending K8s Clusters
45mKubernetes Runtime Security
38mKubernetes Security: Attacking and Defending K8s Clusters
01h 24mTutorial: Attacking and Defending Kube...
12mKeynote: Security and the OODA Loop - Liz Rice, Technology Evangelist, Aqua Security
11mKeynote: Security and the OODA Loop
32mKubeCapture: A Live Hacking Showcase on Kubernetes Security