Lightning Talk: Secure, Least Privilege Cloud Service provisioning with Crossplane - Lewis Marshall
summary
Crossplane can use cloud managed, short‑lived credentials instead of stored keys by leveraging injected identity on EKS, but that currently binds one identity to an installation. The proposal and upstream issues add assume role arn support and per‑resource scoped provider configs so each resource gets narrowly scoped, auditable access. Providers for GCP (workload identity) and Azure need matching changes, and static analysis to publish required permissions lets operators verify least‑privilege without manual code audits.
AI-written summary · about
chapters (5)
related talks
30mGetting to Know Crossplane
17mCrossplane: Deploy Your Cloud Components from Your K8S Cluster
05mExpanding Crossplane’s Reach - Providers, Bridges, and Exten...
23mIntroduction to Crossplane and Simplifying Cloud Native Infrastructure Management
05mLightning Talk: Don’t Make Me Impersonate My Identity
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
35mBuilding and Enabling APIs with Crossplane 1
24mBeyond Infra/Service Provision: The Crossplane Essentials and Adoption