Lightning Talk: Making Sense of Observability with Auto-Discovered Security Policies
summary
An open-source Kubernetes plugin called Discovery Engine automatically generates runtime network and system policies by consuming CNI visibility across clusters, aggregating noisy logs into reusable rules and using pod labels instead of IPs. It produces least-permissive policies from differential CI/CD snapshots, integrates with KubeArmor and Cilium, and outputs a compact policy set that can be tested early in pipelines and pushed to production to keep security posture in sync with application changes.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:50The Problem
- 1:56Challenges to identify security policies from observability data
- 2:42The Solution: Auto Discovered Policies
- 4:39Discovery Engine
- 5:25Summary
related talks
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
24mOne stop talk for kubernetes security !!
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
30mPod Security as an Afterthought
05mKeynote: Crossing the Kubernetes Network Policy Chasm
06mLightning Talk: Why you Should Really Pay Attention to K8S Security Best Practices - Benjy Portnoy
46mKubernetes Policy WG Deep Dive