The Art of (Cloud Native) Defense: Pillars of Kubernetes Security
summary
Outlines concrete pillars: artifact and dependency bill of materials, image signing and vulnerability scanning; safe builds and pipeline gatekeepers that enforce policy before deploy; in-cluster hardening with RBAC, network policies, secrets backed by external managers and rotation (mentions Falco for runtime detection, Kata Containers for stronger isolation, Cilium/Calico for networking); three isolation models — soft multitenancy, virtualized control planes, dedicated clusters — with tradeoffs and operational costs; announces a Permission Monitor open source project for permissions and compliance.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:03Talk focus and community
- 5:01Kubernetes evolution
- 10:43Cloud native security challenges
- 13:14Kubernetes security scope
- 14:38Key security pillars
- 17:45Artifact and dependency security
- 19:58Secure CI/CD pipelines
- 21:42In-cluster security fundamentals
- 23:29Managing secrets at scale
- 25:15Runtime security protections
- 26:41Policy enforcement and governance
- 27:22Network security and service meshes
- 28:45Identity and workload isolation
- 30:10Multi-tenancy approaches
- 33:01Virtualized control planes
- 35:50Secure Kubernetes operations
- 36:54Compliance automation
- 37:14Conclusion and key takeaways
related talks
22mSecuring Kubernetes
53mFlying Above the Clouds: Securing Kubernetes
20mDefense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within
43mKubernetes Security: Attacking and Defending Modern Infrastructure
19mHow to Secure Your Kubernetes Clusters
35mCloud Native Security for the Rest of Us
35mKubernetes Security - Challenge and Opportunity?
43mKubernetes Tower Defense