Lifecycle of a kubectl Command: Harden Kubernetes Setup with Automation
summary
Booking.com runs tens of on‑prem multi‑tenant clusters serving ~500 services and automates namespace onboarding end‑to‑end with zero human intervention. A custom namespace controller watches an internal Service Catalog and creates namespace, roleBinding, ResourceQuota and LimitRange. CLI auth uses an exec auth plugin that returns short tokens validated by a custom auth webhook against the company IAM; requests then pass through mutating/validating webhooks and PSPs before scheduling, enforcing quotas and image/label policies.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:39Agenda
- 2:09Deployment Workflow
- 3:31Challenges
- 9:11Lifecycle of a kubectl command
- 14:27Workspace Provisioning (Recap)
- 16:28Admission Webhook (Mutation)
- 22:17Admission Webhook (Validation)
- 26:44Pod Security Policy (PSP)
- 30:57Pod Security Policy (Ordering)
- 31:29Key Takeaways
- 32:23Questions
related talks
45mKubernetes Operability Tooling
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
29mManaging a Multi-Tenanted Kubernetes Cluster in Production
28mThe Building Blocks of DX: K8s Evolution From CLI to GitOps
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
35mImperative to Declarative Infrastructure by For Developers and Operators
35mThriving With Kubernetes On-Call: Best Practices & Lessons Learned
33mHow the Basics Of Kubernetes Auth Scale For Organizations