cyber.hendryadrian.com
Interesting Stuff · wiz.io

10 Security-Focused Sessions to Watch at KubeCon + CloudNativeCon North America 2022

· Original article ↗

Summary

A curated guide to KubeCon + CloudNativeCon North America 2022 sessions on Kubernetes security, cloud attack paths, policy migration, software supply chains, and integrating security testing into CI/CD.

Key points

  • One session demonstrates using eBPF-based tools to generate Kubernetes network, seccomp, and Linux capability policies from observed application behavior.
  • A demo-driven session covers attack paths between managed Kubernetes clusters and cloud resources, along with configuration best practices for EKS, AKS, and GKE.
  • A session explains migration from the removed PodSecurityPolicy to Pod Security Admission and alternative approaches.
  • The Argo Project session covers security processes, external vulnerability reporting, engineering practices, SBOMs, and fuzzing.
  • A supply-chain session presents using Sigstore, SPIFFE/SPIRE, Tekton, and in-toto to verify identities and software provenance.
  • A CI/CD session demonstrates running security scans and packaging a cloud-native application within a pull request before deployment to Kubernetes.

Article Details

Topic
Recommended security and cloud-native sessions at KubeCon + CloudNativeCon North America 2022.

Products

ArgoHow the Argo Project Transitioned From Security Aware To Security First CiliumCilium Updates, News And Roadmap Cosignstored on the Sigstore Binary Transparency Log (Rekor), signed and verified by use of Keyless Signatures (Cosign) and the Sigstore Certificate Authority (Fulcio), and stored in an OCI registry where it can be verified,Fulciosigned and verified by use of Keyless Signatures (Cosign) and the Sigstore Certificate Authority (Fulcio), and stored in an OCI registry where it can be verified, discovered, and used in policy engines. Backedin-totoVerifiable, Zero-Trust Supply Chain. Additionally, TektonCD will be used as the example build system and in-toto as the example provenance format. Kubernetesevents for cloud-native technologies. You will be able to learn, exchange, and network with peers about Kubernetes but also about containers and new development frameworks. For those who can't attend in person, it isSigstoreZero Trust Supply Chains with Project Sigstore and SPIFFE SPIFFEZero Trust Supply Chains with Project Sigstore and SPIFFE SPIREit can be verified, discovered, and used in policy engines. Backed by SPIFFE’s reference implementation SPIRE, all cryptographic operations are rooted in a strongly attested universal identity control plane forTektonCDthe use of Sigstore and SPIRE for a Federated, Verifiable, Zero-Trust Supply Chain. Additionally, TektonCD will be used as the example build system and in-toto as the example provenance format. 

Tools

inspektor gadgetmentioned above by monitoring the application's events with the following eBPF-based tools: - Inspektor Gadget - Kubernetes Security Profiles Operator - oci-seccomp-bpf-hook We'll discuss the limitations of thisKubernetes Security Profiles Operatorthe application's events with the following eBPF-based tools: - Inspektor Gadget - Kubernetes Security Profiles Operator - oci-seccomp-bpf-hook We'll discuss the limitations of this approach and the future aheadoci-seccomp-bpf-hookwith the following eBPF-based tools: - Inspektor Gadget - Kubernetes Security Profiles Operator - oci-seccomp-bpf-hook We'll discuss the limitations of this approach and the future ahead of these tools. Finally, weRekorpublicly distributed artifacts. This metadata is in turn stored on the Sigstore Binary Transparency Log (Rekor), signed and verified by use of Keyless Signatures (Cosign) and the Sigstore Certificate Authority

Related Articles