Guardians of Multi-Tenancy: Enhanced Authorization To Prevent Lateral Node Escape

on YouTube ↗37m

" summary

Covers preventing lateral node escape in multi-tenant Kubernetes clusters by using recent SIG features—CRD Field Selectors, Field and Label Selector Authorization, Validating Admission Policy (VAP), and Structured Authorization Config—to create finer-grained, node-specific restrictions. Demonstrates using Common Expression Language (CEL) to write custom policies for Authorization Webhooks and VAP, and shares lessons learned from real node escape incidents involving daemonsets.

AI-written summary · about

" related talks

• 25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and VisibilityAbhinav Mishra · Multi-TenancyCon Europe 2024
• 37mMulti-Tenancy in Kubernetes: Best Practices Today, and Future DirectionsDavid Oppenheimer · KubeCon + CloudNativeCon Europe 2018
• 29mManaging a Multi-Tenanted Kubernetes Cluster in ProductionJosh Bowen · KubeCon + CloudNativeCon North America 2016
• 38mMulti-Tenancy WG Deep DiveDavid Oppenheimer · KubeCon + CloudNativeCon Europe 2018
• 01h 00mArchitecting multi-tenant PaaS offeringsJudah Bernstein, Ranjith Raman · AWS re:Invent 2019 Global Partner Summit
• 35mDeep Dive: Kubernetes Working Group for Multi-tenancyAdrian Ludwin, Sanjeev Rampal · KubeCon + CloudNativeCon North America 2019
• 36mFrom the Cluster to the Cloud: Lateral Movements in KubernetesYossi Weizman, Ram Pliskin · CloudNativeSecurityCon North America 2023
• 40mPanel Discussion: Multi-Tenancy in Kubernetes: Current State and Future RoadmapTasha Drew, Ryan Bezdicek, Sanjeev Rampal, Erica Von Buelow · KubeCon + CloudNativeCon Europe 2019