KubeCon Europe 2023 Highlights Practical Kubernetes Security Talks
Summary
A curated guide to KubeCon Europe 2023 talks on Kubernetes security, covering secrets, pod security migration, least-privilege containers, network policies, Zero Trust threat modeling, and managed-cluster risks.
Key points
- Talks cover Kubernetes secrets management, including secret store providers and the Secrets CSI.
- A session discusses migrating workloads from Pod Security Policies to Pod Security Admission and identifying deployment issues.
- Google speakers describe challenges and design choices for running GKE containers as non-root, including user namespaces.
- A Shopify talk demonstrates using Inspektor Gadget to create workload seccomp profiles and network policies.
- A Zero Trust threat-modeling session demonstrates security controls including SPIRE and OPA.
- The article highlights a talk about attack chains originating from middleware in managed GKE, AKS, and EKS clusters.
Article Details
- Topic
- Security talks at KubeCon + CloudNativeCon Europe 2023 covering Kubernetes secrets management, pod security, container privileges, network security, Zero Trust threat modeling, and managed-cluster risks.
People
Cailyn EdwardsPresented a talk on Kubernetes network security.Christian SchlotterPresented a talk on migrating workloads to Pod Security Admission.Gal CohenPresented a talk on secret management in Kubernetes.Greg CastlePresented a talk on migrating GKE containers to non-root execution.James CallaghanPresented a talk on Zero Trust environment threat modeling.Liav YonaPresented a talk on secret management in Kubernetes.Richard FeatherstonePresented a talk on Zero Trust environment threat modeling.V. KörbesPresented a talk on migrating workloads to Pod Security Admission.Vinayak GoyalPresented a talk on migrating GKE containers to non-root execution.
Vendors
Fireflyin Kubernetes – Every production application today utilizes secrets. Gal Cohen and Liav Yona from Firefly provide an overview of the use cases and challenges of secrets in Kubernetes. They then discuss theGoogledifficulties and the privileges required by numerous processes. Greg Castle and Vinayak Goyal from Google offer their unique perspective on migrating GKE containers to non-root at scale. They explain theShopifyCanals and Bridges: Using Amsterdam’s Transit System to Secure K8s Networks – Cailyn Edwards from Shopify provides a fresh take on Kubernetes by comparing it to the Amsterdam canal system. This analogy proves effectiveVMwareof privilege not easily mappable to PSS. In this timely talk, V. Körbes and Christian Schlotter from VMware tackle K8s workload migration to Pod Security Admission and describe the steps needed to identify issues
Products
AKSLast but not least, if you run managed GKE, AKS, or EKS clusters and want to know what kind of security risks they carry, you are invited to watch our talk, Cluster Grey Zone: Risks in Managed Cluster Middleware. ItEKSLast but not least, if you run managed GKE, AKS, or EKS clusters and want to know what kind of security risks they carry, you are invited to watch our talk, Cluster Grey Zone: Risks in Managed Cluster Middleware. ItGKEnumerous processes. Greg Castle and Vinayak Goyal from Google offer their unique perspective on migrating GKE containers to non-root at scale. They explain the challenges they faced and the design choices behind theirKubernetesCan You Keep a Secret? on Secret Management in Kubernetes – Every production application today utilizes secrets. Gal Cohen and Liav Yona from Firefly provide an overview of the use cases and challenges of secrets inOpen Policy Agent (OPA)are especially valuable in showing the practical applications of security controls (including Spire and OPA) used during the mitigation stage.Pod Security AdmissionPractical Challenges with Pod Security Admission – Now is the time to migrate from Pod Security Policies (PSP) to Pod Security Standards (PSS). The problem is, many workloads require some degree of privilege not easilyPod Security PoliciesPractical Challenges with Pod Security Admission – Now is the time to migrate from Pod Security Policies (PSP) to Pod Security Standards (PSS). The problem is, many workloads require some degree of privilege not easilyPod Security Standardswith Pod Security Admission – Now is the time to migrate from Pod Security Policies (PSP) to Pod Security Standards (PSS). The problem is, many workloads require some degree of privilege not easily mappable toSPIRETheir demos are especially valuable in showing the practical applications of security controls (including Spire and OPA) used during the mitigation stage.