PSP is Dead, Long Live PodSecurity
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 16:30· Room 501 ABC + Online·
summary
Kubernetes replaces PodSecurityPolicy with pod security admission implemented as a modular admission controller aiming for beta in 1.23; it enforces three profiles only: privileged, baseline and restricted, with namespace-label-driven modes enforce/audit/warn. The code exposes a registry of versioned checks, unit tests that emit passing/failing YAML, and a standalone CLI for CI so validations run without an API server. Other auth work reached GA: bound service account tokens and kubectl credential plugins, plus certificates API GA and a Secret CSI driver subproject.
AI-written summary · about
chapters (4)
- 0:00Start
- 0:29What do we do? SIG-Auth is responsible for features in Kubernetes that control and protect access to the API and other core components. This includes authentication and authorization, but also encompasses features like auditing and some security policy
- 1:01Highlight Reel • Pod Security approaching Beta! • Certificates API is GA • Exec Auth Kubect Credential Provider is GA Secrets CSI is approaching GA
- 6:03Pod Security Policy "v2" Pod Security Pod Security Admission PSA
related talks
40mKubernetes Security After Pod Security Policies Removal
36mKubernetes Security After Pod Security Policies Removal
35mMigrating From PodSecurityPolicy
37mHandsOn PodSecurity Policies
26mSecure Containers Deployments: Time for Refresh
41mUsing Pod Security Policies to harden your Kubernetes cluster
33mBringing Pod Security Admission to Your Kubernetes Distribution
26mReplacing PSPs? Keep Bad Pods out of your cluster using Kyverno!