Securing Clusters with Kubernetes Extensibility

Slide 1

Slide 1 text

4FDVSJOH$MVTUFSTXJUI ,VCFSOFUFT&YUFOTJCJMJUZ "ZB0[BXB !MBEJDMF 5BLBTIJ,VTVNJ ,VCFSOFUFT$MPVE/BUJWF.FFUVQ

Slide 2

Slide 2 text

"CPVUVT "ZB0[BXB!MBEJDMF 4PGUXBSF&OHJOFFS BU;-BC$PSQ 5BLBTIJ,VTVNJ 4PGUXBSF&OHJOFFS BU;-BC$PSQ

Slide 3

Slide 3 text

"ZB 5BLBTIJ 5PEBZˏTBHFOEB ,VCFSOFUFTBTB4FSWJDFGPS:BIPP+BQBO )PXTIPVMEXFDPOUSPMBDDFTTUPUIF,VCFSOFUFT"1*TFSWFS 8IBUJT+85BOE3#"$ BOE)PXUPVTFJU 3#"$JT/05FOPVHI %FNPOTUSBUJPOPGQSJWJMFHFFTDBMBUJPO 4FDVSJOH,VCFSOFUFTXJUI7BMJEBUJOH"ENJTTJPO8FCIPPL

Slide 4

Slide 4 text

;-BC,VCFSOFUFTBTB4FSWJDF 4 .BTUFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS Ӝ4FMGIFBMJOHUIFXIPMF DMVTUFS Ӝ4DBMJOHDMVTUFSFBTJMZ Ӝ;FSPEPXOUJNFVQHSBEF DMVTUFSWFSTJPO .BKPS'FBUVSFT .BTUFS$MVTUFSNBOBHFTNVMUJQMF6TFS ,VCFSOFUFT$MVTUFSBOEJUTFMGVTJOH$3%

Slide 5

Slide 5 text

)PXTIPVMEXFDPOUSPMBDDFTT 5 .BTUFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS "QQ %FWFMPQFS "QQ %FWFMPQFS "QQ 0QFSBUPS LT 0QFSBUPS "UUBDLFS ✖%&/:

Slide 6

Slide 6 text

"DDFTT$POUSPM

Slide 7

Slide 7 text

TUFQT"DDFTT$POUSPM 7 "VUIFOUJDBUJPO "VUI/ "VUIPSJ[BUJPO "VUI; "ENJTTJPO $POUSPM "1*4FSWFS "DDFTT

Slide 8

Slide 8 text

"MMPX 8IBUIBQQFOTJOFBDITUFQ 8 "DDFTT 8IPBSFZPV ✔$SFBUF9 ✖%FMFUF:  8IBUDBOZPVEP %FOZ %FOZ %FOZ 7BMJEBUJOH .PEJGZJOH ٥٥٥ "MMPX "MMPX "VUI/ "VUI; "ENJTTJPO$POUSPM

Slide 9

Slide 9 text

"DDFTT$POUSPMNPEVMFT 9 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$ 3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO 8FCIPPL FUD FUD FUD

Slide 10

Slide 10 text

8IZEPXFVTF+85 10 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$ 3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO FUD FUD FUD Ӝ %ZOBNJDVTFSBVUIFOUJDBUJPO Ӝ 1BTTXPSEBOE1MBOF5PLFONPEVMFT SFRVJSFUPTFU"VUI/TFUUJOHXIFOCPPUJOH "1*TFSWFS Ӝ 4FWFSBM0*%$*E1TTVQQPSUUIJTNPEVMF

Slide 11

Slide 11 text

8IZEPXFVTF3#"$ 11 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$ 3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO FUD FUD FUD Ӝ %ZOBNJDBDDFTTBVUIPSJ[BUJPO Ӝ /PBEEJUJPOBMEFWFMPQNFOU Ӝ 3#"$TFUUJOHTDBOCF DPOSNFECZLVCFDUMMJLFBOZ PUIFSSFTPVSDFT /05&*GZPVBMSFBEZIBWF"VUI;TZTUFN 8FCIPPLJTBHPPEDIPJDF

Slide 12

Slide 12 text

"VUI/+85 4FSWJDF"DDPVOU0*%$

Slide 13

Slide 13 text

5XPDBUFHPSJFTPG6TFST 13 "1*4FSWFS "DDFTT 6TFSNBOBHFECZLT FH#PU /PSNBM6TFS FH"MJDF

Slide 14

Slide 14 text

#PUI4"BOE0*%$VTJOH+85 14 "1*4FSWFS 6TFSNBOBHFECZLT FH#PU /PSNBM6TFS FH"MJDF +85 +85 (FU+85GSPNB0*%$*E1 (FU+85GSPN B4FSWJDF"DDPVOU

Slide 15

Slide 15 text

4"4FDSFUIBT+85 15 $SFBUFBCPU4" JOUIFTZTUFN/4 %FUFDUUIF DSFBUJPOFWFOU $SFBUFBCPU4"4FDSFU XJUI+85JOUIFTZTUFN/4 5PLFO $POUSPMMFS 4FSWJDF "DDPVOU 4FDSFU +85

Slide 16

Slide 16 text

4"$POUSPMMFSDSFBUFTEFGBVMU4"GPSBMM/4 16 $SFBUFTZTUFN /BNFTQBDF $SFBUFEFGBVMU 4"JOTZTUFN/4 4" $POUSPMMFS 4FSWJDF "DDPVOU /BNF TQBDF %FUFDUUIF DSFBUJPOFWFOU

Slide 17

Slide 17 text

7PMVNF "MM1PETBTTPDJBUF4FSWJDF"DDPVOU 17 4""ENJTTJPO $POUSPMMFS .PVOU $SFBUF1PE 4FUEFGBVMU/"*GUIF 1PEEPFTOPUIBWF4" 4FDSFU +85 1PE 4FU*NBHF1VMM4FDSFUTPG4"*G UIF1PEEPFTOPUIBWFJU 4FU4FDSFUPG4"UPUIF1PEWPMVNF .PEJGZ1PE

Slide 18

Slide 18 text

%FY0QFO*%$POOFDU*%1SPWJEFS 18 %FY 0*%$*E1 3FEJSFDU +85 6QTUSFBN*E1 FH'BDFCPPL $MJFOU IUUQTHJUIVCDPNEFYJEQEFY 0*%$JTBTJNQMFJEFOUJUZMBZFSPO UPQPGUIF0"VUIQSPUPDPM

Slide 19

Slide 19 text

+40/8FC5PLFODPOTJTUTPGQBSUT 19 )FBEFS 1BZMPBE 4JHOBUVSF IUUQTKXUJP

Slide 20

Slide 20 text

7FSJGZJOH+85PG0*%$ 20 "1*4FSWFS LVCFDUM +85 $BMM"1*XJUI+85 *T+85TJHOBUVSFWBMJE )BTUIF+85FYQJSFE MBUFYQ 6TFS"VUIPSJ[FE 3FUVSOSFTVMU "VUIPSJ[BUJPO#FBSFS+85 ⚠/05& 4"ˏT+85EPFTOPUIBWFFYQJSBUJPOEBUF BOEJUJTOPUSPUBUFE

Slide 21

Slide 21 text

"VUI;3#"$

Slide 22

Slide 22 text

3PMF#BTF"DDFTT$POUSPM 22 "DDFTT %FOZ "MMPX 7JFXFS3PMF 4VCKFDU 3PMF Y $POUSPM #PC 7JFXFSDBOHFU SFTPVSDFT IBTSVMFTUIBU #JOEJOH NBOBHFS(SPVQ BOE 7JFXFS3PMF *G#PCJTB NBOBHFS *G#PCJTOPU BNBOBHFS "DDFTT6TFSJT #PC

Slide 23

Slide 23 text

3PMF 3PMF #JOEJOHT 3PMF 3#"$JO,VCFSOFUFT 23 Y $POUSPM Ӝ4" Ӝ6TFS Ӝ(SPVQ /PSNBM6TFS ,T6TFS "VUIFOUJDBUFE6TFS %FOZ "MMPX ,VCFSOFUFT"1*0CKFDU subjects: - kind: Group name: manager roleRef: kind: Role name: viewer 4VCKFDU "DDFTT

Slide 24

Slide 24 text

3PMF 3PMF #JOEJOHT 3PMF 3#"$JO,VCFSOFUFT 24 Y $POUSPM %FOZ "MMPX ,VCFSOFUFT"1*0CKFDU metadata: name: viewer rules: - apiGroups: [""] resources: ["pods","pods/exec"] verbs: ["get","list","watch"] - nonResourceURLs: ["/version","/healthz"] verbs: [""] 4VCKFDU Ӝ4" Ӝ6TFS Ӝ(SPVQ /PSNBM6TFS ,T6TFS "VUIFOUJDBUFE6TFS "DDFTT

Slide 25

Slide 25 text

8IJDI3#"$SFTPVSDFTTIPVMEZPVVTF 25 #JOEJOHT $MVTUFS3PMF#JOEJOHT 3PMF (SBOUQFSNJTTJPOTUPSFTPVSDFTJOUIF TQFDJDOBNFTQBDF $MVTUFS 3PMF 6TF$MVTUFS3PMFGSPNNVMUJQMF OBNFTQBDFT ˖ (SBOUBDDFTTUPOPO"1*SFTPVSDFT ˖ (SBOUBDDFTTQFSNJTTJPOUPSFTPVSDFTPG BMMOBNFTQBDFT $MVTUFS999EPFTOPUCFMPOH UPUIF/BNFTQBDFT

Slide 26

Slide 26 text

#VU3#"$JT/05FOPVHI

Slide 27

Slide 27 text

1SFWFOUQSJWJMFHFFTDBMBUJPO Ӝ  Ӝ  DBOPCUBJOIPTUTSPPUCZNPVOUJOH%PDLFSTPDLFU Ӝ  DBOBDDFTTIPTUTMFTZTUFNWJBQSPD<1*%>SPPU Ӝ  ☠5IFTFBSFFTFOUJBMMZFRVJWBMFOUUPSPPUPOUIFIPTU

Slide 28

Slide 28 text

SPOILER ALERT! :PVDBOVTF 1PE4FDVSJUZ1PMJDZ PS 7BMJEBUJOH"ENJTTJPO8FCIPPL UPQSFWFOUJU

Slide 29

Slide 29 text

%FNP1SJWJMFHFFTDBMBUJPOCZIPTU1BUI 29 IUUQTBTDJJOFNBPSHBG'+X+E4F#S)S%V.

Slide 30

Slide 30 text

)PXUPQSFWFOUQSJWJMFHFFTDBMBUJPO Ӝ 1PE4FDVSJUZ1PMJDZ %FOFBOENBOBHFTFDVSJUZQPMJDZXJUI3#"$ "EEUPUPVTFJU OFFEUPSFTUBSULVCFBQJTFSWFS $BOOPUDSFBUFBOZQPETXJUIPVUQPMJDZ OPEFGBVMUQSPWJEFE Ӝ 7BMJEBUJOH"ENJTTJPO8FCIPPL *NQMFNFOUZPVSPXOQPMJDZ DBOCFEZOBNJDBMMZDPOHVSFECZ /POFFEUPSFTUBSULVCFBQJTFSWFS

Slide 31

Slide 31 text

7BMJEBUJOH"ENJTTJPO8FCIPPL "1*4FSWFS :PVS8FCIPPL                *TUIFPCKFDUBMMPXFE ZFTOP

Slide 32

Slide 32 text

4VNNBSZ Ӝ $VTUPN3FTPVSDF%FOJUJPO UPDSFBUF,VCFSOFUFTBTB4FSWJDFJUTFMG Ӝ 0QFO*%$POOFDU"VUIPSJ[BUJPO8FCIPPL UPJOUFHSBUFPVSBVUIOBVUI[TZTUFN Ӝ 7BMJEBUJOH"ENJTTJPO8FCIPPL UPQSFWFOUQSJWJMFHFFTDBMBUJPOBOEJNQMFNFOUDVTUPNQPMJDZ ,VCFSOFUFTFYUFOTJCJMJUZBSFBMTPVTFGVMUPTFDVSFDMVTUFST

Slide 33

Slide 33 text

8FBSFIJSJOH CJUMZ[MBCDBSFFST