A Raccoon And a Group Of Turtles Secure Clusters Together!
Talkat KubeCon + CloudNativeCon North America 2022 · on Wednesday, 2022-10-26· at 11:55· Ambassador Ballroom (Room 360)·
summary
A community-run self-assessment produces the first security review of Cluster API: team narrows scope to create clusters on popular clouds, builds detailed data flow diagrams with Excalidraw, documents threats using STRIDE, converts notes to markdown and lands a PR that sparks 72 PR threads. Outcomes include a merged assessment, issues filed under security-self-assessment, CNCF funding to run continuous fuzzing via OSS-Fuzz on Google infrastructure, and a checklist of prioritized fixes plus an open question about scalable vulnerability reporting for Kubernetes subprojects.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:34What's with the animals?
- 4:58How it started?
- 11:02Scoping
- 13:52Data Flow Diagrams
- 18:36Changes: Roles and Responsibilities
- 19:57Fuzz Testing
- 20:58Final outcome
- 21:08What's Next?
- 23:24Lessons Learned
related talks
36mThe Devil in the Details: Kubernetes’ First Security Assessment
17mA Sneak Peak Into Security Reviews with the Community
36mThe Devil in the Details: Kubernetes’ First Security Assessment
31mCloud Security Wildlife: A Tale of Otters, Monkeys and Security?
22mSecuring Kubernetes
30mWhat We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
34mIntegrating Cloud Native Security into the SRE culture
39mPiloting Around the Rocks: Avoiding Threats in Kubernetes