Security Best Practices for AI on Kubernetes
summary
Shows how to secure AI workloads on Kubernetes by creating service account per researcher and one namespace each, mounting per-user NFS directories via PV/PVC with POSIX permissions, and enforcing the pod security admission restricted profile to ban root and privilege escalation. Demo uses Run:AI environment, kubectl, NFS, and a GPU node, shows an insecure pod blocked, then a compliant pod launched running as UID 501, no sudo, and able to read only the user’s mounted data.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:27Data Scientists are using containers
- 2:12Kubernetes for orchestrating containers
- 2:51What do Data Scientists need?
- 4:52Security Best Practices #3
- 20:40Summary
related talks
18mPreventing Bank Heists and AI Takeovers in Kubernetes
25mWhat We Learned Securing AI Agents at Scale on Multi-Tenant Kubernetes Clusters
25mSecuring AI Pipelines: Real-World Attacks on Kubernetes-Based AI Infrastructure
30mSecuring^WAttacking Kubernetes
33mSecuring Kubernetes in the Cloud
37mSecure By Design: Architecting cloud and AI workloads from the perspective of infosec
29mKubernetes Security Best Practices
22mAI in Kubernetes The Promise