Securing Jenkins with Pod Security Policies
Talkat Continuous Delivery Summit 2019 - San Diego · on Monday, 2019-11-18· at 00:00· San Diego Convention Center - Room 1, 131 W Harbor Dr·
summary
Jenkins on Kubernetes uses PodSecurityPolicy (cluster-level, beta but supported by major clouds) plus RBAC, namespaces and node pools to limit blast radius. Example restrictive settings: privileged: false, allowPrivilegeEscalation: false, disallow hostPath (blocks mounting /var/run/docker.sock), set seccomp and AppArmor to default and runAsUser: 1000. Note: Jenkins Kubernetes agents mount emptyDir as root (0750) so builds fail unless podTemplate securityContext matches agent UID or the plugin’s new dynamic PVCs are used.
AI-written summary · about
related talks
29mKubernetes Security Best Practices
41mKubernetes Security Jumpstart
38mUsing Containers for Continuous Integration and Continuous Delivery [I]
38mAn Intro to Kubernetes Hardening
31mThe Hitchhiker's Guide to Pod Security
28mKubernetes Security Low-Hanging Fruit
05mJenkins in the Cloud
40mKubernetes Security After Pod Security Policies Removal