SIG Auth Deep Dive
summary
SIG Auth updates include Pod Security Admission GA (1.25) and removal of PodSecurityPolicy, certificates API and token requests reaching GA, and the secret-store CSI driver going GA. Ongoing work includes KMSv2 alpha to avoid serial decrypts and expose key metadata, a trust anchor sets API to share CA bundles cluster-wide, and a proposal for client-go exec plugin proxy auth. Demo walks an exec-credential implementation using OIDC password grant, local file caching, stdin for interactive login, and emitting ExecCredential JSON for kubectl.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:31SIG Auth Deep Dive
- 11:20What is it?
- 15:28Sample Plugin
- 16:32Entrypoint
- 17:06KUBERNETES_EXEC_INFO
- 19:08Caching: get from cache
- 20:49Reading username and password from stdin
related talks
01h 32mSIG Auth Update and Deep Dive
24mSIG Security: Succession Pla ...
31mStrengthening Auth in Kubernetes: Image Pulling, DRA Admin Access & Pod Certificates
22mSecurity Through Transparency: Kubernetes SIG Security Update
39mDeep Dive: Auth SIG
36mSig Auth Deep Dive
26mIntro: Auth SIG
34mSIG Security: Empowerment Through Autonomy