Choose Your Own Adventure: The Struggle for Security
summary
Live demo uses AWS EKS + Crossplane + Argo CD and an app already running behind Contour; cluster-level policy choices are Kyverno, OPA Gatekeeper, and CU-warde(n)/CUE-based policies — audience picks CU-warden and a replica-count admission policy blocks deployment until replicas >=3, then Argo CD syncs and deployment succeeds. Runtime contenders are Falco vs KubeArmor (LSM + eBPF) — KubeArmor blocks forbidden execs in the pod. Secrets options are External Secrets, CSI driver, and Sops; External Secrets operator syncs an AWS secret into a Kubernetes Secret that the app uses.
AI-written summary · about
chapters (8)
- 0:00Security adventure intro
- 3:33Admission controller policies
- 8:38CUE Warden demo
- 16:18Runtime policy importance
- 20:09CUBE Armor demo
- 22:57Kubernetes secrets management
- 27:18External Secrets Operator demo
- 30:53Summary and resources
related talks
31mChoose Your Own Adventure: The Struggle for Security
24mOne stop talk for kubernetes security !!
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
43mA Confidential Story of Well-Kept Secrets
53mFlying Above the Clouds: Securing Kubernetes
35mCloud Native Security for the Rest of Us
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
41mKubernetes Security Jumpstart