Putting Hackers Breaching Your Cluster In Automatic Quarantine
summary
Claim: breaches are inevitable so enforce egress at pod level. Survey of 15 Helm packages finds only four include any egress controls. Built an automation flow using NP Guard that analyzes manifests, synthesizes Kubernetes NetworkPolicies, opens a PR, posts a connectivity map and a connectivity diff, and checks organizational rules before merge. Demo runs via GitHub Actions, generates one NetworkPolicy per service, blocks hundreds of previously allowed connections, and prevents noncompliant changes from being merged.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:32A scary thing...
- 1:03Why is it so scary?
- 2:46And there is compliance...
- 3:26Why then is egress so exposed?
- 6:08A word about controlling egress
- 7:50A mini-survey of common OSS
- 9:07Egress control done right
- 9:54Automation can help - observability
- 11:29Automation can help - synthesis
- 12:39NP-Guard's shift-left vision
- 14:35NP-Guard demo
- 23:37Summary
related talks
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
36mHow to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz
29mKubernetes Security: Attacking and Defending K8s Clusters
28mClosing the Loop: Applying Least Privilege and Ensuring We Did It Well
19mHacking Kubernetes
35mKubernetes Security - Challenge and Opportunity?
43mKubernetes Security: Attacking and Defending Modern Infrastructure
30mFortifying Kubernetes