Lightning Talk: Kubeflow Security Working Group Update 2024
Lightningat Kubeflow Summit Europe 2024 · on Tuesday, 2024-03-19· at 14:55· Pavilion 7 | Level 7.3 | Room S02·
summary
Security working group reports concrete changes for Kubeflow 1.9: swap the OIDC/off-service with an of2 proxy to enable token‑based machine‑to‑machine auth, optional network policies as a second defense layer, and a rootless proof of concept in the Manifest repo aiming for ~99% rootless containers. CVE counts drop but many issues come from OS/external deps; an automatic CVE scanning script (use trivy on images extracted from Manifests) exists but full automation and dependency rebases remain work in progress. Major unresolved items: multitenancy for object and metadata stores and namespace isolation.
AI-written summary · about
chapters (8)
- 0:00Kubeflow Security WG intro
- 1:44Multitenancy challenges
- 2:29CVE scanning updates
- 3:10OIDC proxy auth overhaul
- 3:55Network policies defense
- 4:16Rootless Kubeflow security
- 5:18Security progress report
- 6:04Q&A security controls
related talks
28mEnabling Kubeflow with Enterprise-Grade Auth for On-Prem Deployments
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
11mKeynote: Securing Kubernetes, the Upstream Way
40mCloud Native Security: A New Paradigm for a New World
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
26mObjection! AI Security Mistakes on Trial With Kubeflow and Confidential Computing
46mContinuous Kubernetes Security
37mCloud Native Security 101 - Introduction, Workflows and Best practices