Navigating the Container Jungle
summary
Shows how Kubernetes plus Project Calico replaces stacked overlays and physical firewalls with a flat L3 network and declarative NetworkPolicy rules (example policy ~25 lines). Demonstrates a live demo: a 5‑replica front end + Redis on port 6379 where enabling namespace isolation and two policies blocks an attack that resets the Redis counter. Policies compile to per‑host iptables, Calico lacks overlapping IPs today and Kubernetes lacks native egress rules; at large scale iptables adds a few percent overhead.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:49A Simple Data Center
- 1:37Separate Dev / Production
- 2:01Deploy some workloads
- 2:25Deploy some isolated workloads
- 4:00Simplified Networking Model
- 7:12User Case Study: Dev, Test, Prod
- 10:01User Case Study: Physical Servers - Containers
- 10:49Dedicated Firewall Device
- 11:37Their Solution
related talks
23mContainer and Kubernetes security policy design: 10 critical best practices
32mContainer and Kubernetes security policy design
52mImplementing holistic security for containers and Kubernetes
32mUsing Open-Source Software to Secure Cloud-Native Applications
40mNoverlay Networks for Health and Wellbeing
06mKeynote: Progress Toward Zero Trust Kubernetes Networks
39mExploring Container Security: A DevSecOps journey securing a fake shop - Jeremy Guerrand
46mContinuous Kubernetes Security