Why Data Stored in Kubernetes Is at Risk and What You Can Do About It
recording made private on YouTubehttps://youtu.be/c-_5jc2yMJE
Talkat Data on Kubernetes Day NA 2025 · on Monday, 2025-11-10· at 14:45· Building B | Level 2 | B211-212·
summary
Persistent volumes and snapshots are often exposed by default; concrete fixes include set reclaimPolicy to Retain and use volumeBindingMode: WaitForFirstConsumer, enable CSI encryption and mount restrictions, and use workload identity with least‑privilege roles for backup jobs. Enforce those defaults with Kyverno or OPA Gatekeeper, audit and alert storage access with Falco and Kubescape, restrict VolumeSnapshot verbs to a small admin scope, and push immutable backups to object storage so snapshots cannot be abused.
AI-written summary · about
related talks
26mKubernetes Data Protection WG Intro and Deep Dive
25mIntro & Deep Dive: Kubernetes Data Protection WG
30mKubernetes Data Protection WG Intro & Deep Dive
31mKubernetes Data Protection WG Intro & Deep Dive
28mKubernetes Data Protection WG Deep Dive
30mKubernetes Data Protection WG Deep Dive
44mSnapshots Aren’t Backups: The Blast Radius Problem in Kubernetes DR
36mPersistent Storage with Kubernetes in Production - Which Solution and Why?