The Devil in the Details: Kubernetes’ First Security Assessment
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 10:55· Room 16AB - San Diego Convention Center, Mezzanine Level·
summary
Year‑long community audit produces 241 pages, a four‑month core assessment, and 37 vulnerabilities reported through the Product Security Committee. Third‑party firms Trail of Bits and Atredis Partners run code review and pen tests, open their repos, and deliver a threat model covering eight components across six trust zones plus an attackers guide, operator white paper, and source assessment; findings include unauthenticated HTTP, cert revocation gaps, pod security policy bypasses, and node→cluster escalation paths.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:29Smarter WG Co-Leads
- 2:07CNCF Sponsorship
- 3:01Ecosystem
- 5:34Philosophy
- 10:06Attacks on Kubernetes
- 12:24An Attacker's view of Kubernetes
- 18:52Threat Model - Highlights
- 21:38Source Assessment - Highlights
- 25:48Call for Action
- 30:14Questions?
- 31:10Resources
related talks
36mThe Devil in the Details: Kubernetes’ First Security Assessment
19mHow to Secure Your Kubernetes Clusters
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
19mKubernetes Security: Navigating the Real-World Challenges
26mMulti-layer hardening in Kubernetes
22mSecurity Through Transparency: Kubernetes SIG Security Update
35mKubernetes Security - Challenge and Opportunity?
11mKeynote: Securing Kubernetes, the Upstream Way