Securing Shopify's PaaS on GKE [I]
summary
Shopify runs its PaaS on GKE serving most internal and business‑critical services and faces missing features like NetworkPolicies and PodSecurityPolicies, so the security team builds platform tooling: ground control to assign GCP service accounts to namespaces, encrypted JSON to store secrets in git, a PIPA builder (6,000 builds/day, ~450,000 images), Grafeas/occurrences + binary authorization to block non‑built images, ~15 cloud buddies (accountabilibuddy, bucket buddy, secret buddy), kubernetes‑deploy, q-bada audits and nosy‑bastard/SSH janitor; automation largely works but scanning remains reactive at this scale.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:14Who am I
- 1:05Kubernetes
- 1:29Service Tier Model
- 2:58How many namespaces
- 3:45Shopifys cloud platform
- 4:11Controlling security
- 4:48Overview
- 5:20Services DB
- 8:24Builder Stats
- 9:04PIPA
- 10:35Griffis
- 13:49Kubernetes Deploy Overview
- 16:28Kubernetes Deployment
- 17:49Cloud Buddies
- 18:30Cloud Buddies Example
- 19:21Storage Example
- 20:16Security Audits
- 24:37Whats Missing
- 27:51Cross Cluster Communication
- 30:20Cloud Audit Logging
- 32:26GCP Identity Provisioning
- 35:14Accountabilibuddy
- 37:41Image Scanning
related talks
33mBuilding Shopify's PaaS on Kubernetes
46mKeep Building Fresh: Shopify's Journey to Kubernetes
16mKeynote: Securing Shopify's Software Supply Chain
40mFun with Continuous Compliance
31mSecuring the Deploy Pipeline
28mKnow Your Kubernetes Deploys
36mZero Trust at Shopify Scale: Automating MTLS Across Thousands of Services
04mKeynote: One Deploy Plane, Every Runtime: How Shopify Generalized Cloud Native Beyon...