Blind Trust is Broken: Securing Your Cluster Against Untrusted Containers
summary
Claims that 85% of images have high or critical vulnerabilities and recommends stopping pulls from public registries by enforcing a single source of truth and images signed by SHA256. Proposes a stack: SUSE Private Registry (Harbor), SUSE Application Collection base images, dual scanning with Vector and Trivy, a WebAssembly-based admission controller (Cube One/Cube Warden) for policy enforcement, and an eBPF runtime enforcer; admission controller is SGA, scanner is technical preview, runtime enforcer targets H1/H2 next year.
AI-written summary · about
chapters (21)
- 0:00Welcome and introduction
- 1:54Blind trust in CI/CD pipelines
- 5:33Container security hard numbers
- 7:18Real-world TeamTNT attack example
- 9:26Blueprint for zero trust clusters
- 11:17Defense model pillars
- 12:42Secure supply chain workflow
- 14:06Solving public registry problem
- 16:55Enterprise-grade open source
- 17:16Single source of truth registry
- 18:18Architectural shift in security
- 19:22SUSE Security 6 roadmap
- 20:03Modular security enforcement
- 20:46Kubernetes admission controller
- 21:49Gatekeeper for cluster security
- 22:31Cube One project policies
- 23:58Runtime scanning with eBPF
- 25:23Security tools availability
- 26:25Future security features
- 26:47Recap and conclusion
- 27:31Q&A session
related talks
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
37mIt’s 2018; Are My Containers Secure Yet?!
37mAchieving High Security at Scale with Microservices
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
24mCracking the Code of Cloud Security
31mImage Provenance and Security in Kubernetes
37mA question of trust: When good containers go bad