Sharing is NOT Caring: Stop Sharing Your Kubernetes Cluster Credentials
summary
Claim: stop handing out kubeconfigs with long‑lived secrets and instead federate identity so each cluster issues short‑lived credentials. Demonstration deploys Pinniped supervisor and concierge to a management/federated cluster topology, wires Dex to GitHub for OIDC, and installs the Pinniped CLI; the concierge mints per‑cluster short‑lived x509 tokens via the token credential request API (with an optional impersonation proxy fallback). The demo succeeds: login yields a GitHub identity, different privileges per cluster, and no kube-apiserver modification required.
AI-written summary · about
chapters (4)
- 0:00Start
- 13:33Integrate with any Kubernetes Cluster without Modifying the Api Server
- 33:39Community Meetings
- 42:42Coffee Break
related talks
10mPinniped: A Unified Framework for User Authentication to Kubernetes Cluster
31mConnecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and Cluster Inventory API
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
33mPortable, Universal Single Sign-On for Your Clusters
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
25mAdministering Multi Cluster Service Meshes Securely
29mEverything Wrong with K8s Authentication and How We Worked Around It
49mCluster Wrangling: How to make Kubernetes clusters secure and usable