Identity Bootstrapping in Multi-tenant Multi-cluster Kubernetes
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 16:25· Room 14AB - San Diego Convention Center, Mezzanine Level·
summary
Volterra demonstrates pod-level x.509 identities issued by a per-customer CA with private keys generated and stored inside each pod so keys never leave the pod, certificates auto-rotate, and identity attributes are configurable for fine-grained policy. A mutating Voucher webhook injects a Wingman sidecar which requests identities from an identity authority and can translate pod identity to cloud IAM. The system is tested across 3,000 clusters and is being open-sourced.
AI-written summary · about
chapters (6)
- 0:00Start
- 10:19Secure Minting and Delivery
- 13:08Rich, Usable, and Extensible
- 22:01Multiple standalone clusters
- 24:00Possible solutions and their drawbacks
- 26:06Feature requirements
related talks
37mCaller ID in Kubernetes
34mThrow Away Your Passwords: Trusting Workload Identity
19mIdentity, Istio, And You
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
26mUntangling the Multi-Cloud Identity and Access Problem With SPIFFE Tornjak
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
05mPromoting Common Standards Without Sacrificing Tenant Autonomy