Cloud Native
Security Talks RSS

KubeCon North America 2019

Identity Bootstrapping in Multi-tenant Multi-cluster Kubernetes

Manish Mehta, Volterra & Derek Suzuki, The Voleon Group

Abstract

With the increasing popularity of Kubernetes, providing managed K8s has been a great way to convert enthusiasts into adopters. However, current solutions mainly focus on providing isolated clusters and adopters are responsible for making workload identities work across clusters. If multi-tenancy is added to the mix, the challenges of bootstrapping identities that work across clusters - but within tenancy - are even greater.In this presentation, the speakers will share challenges of securely bootstrapping identities in such a setup (especially when the individual clusters could be running in untrusted environments), the tradeoffs, and possible solutions. Manish will also introduce planned open-source components of a solution used by Volterra Edge Services for identity bootstrapping and other security services.

More from KubeCon North America 2019

Open in the index →
  1. Walls Within Walls: What if Your Attacker Knows Parkour?Tim Allclair & Greg Castle, Google 2019-11-19
  2. The Devil in the Details: Kubernetes’ First Security AssessmentAaron Small, Google & Jay Beale, InGuardians 2019-11-19
  3. Panel: Control Plane vs Data Plane: Untangling the Tenets of MultitenancyTasha Drew, VMware; Sanjeev Rampal, Cisco; Ryan Bezdicek, Cray Inc.; Adrian Ludwin, Google; & Fei Guo, Alibaba 2019-11-19
  4. Enforcing Automatic mTLS with Linkerd and OPA GatekeeperIvan Sim, Buoyant & Rita Zhang, Microsoft 2019-11-19
  5. CAP_NET_RAW and ARP Spoofing in Your Cluster: It's Going Downhill From HereLiz Rice, Aqua Security 2019-11-19
  6. Redesigning Notary in a Multi-registry WorldJustin Cormack, Docker 2019-11-20
  7. Piloting Around the Rocks: Avoiding Threats in KubernetesRobert Tonic & Stefan Edwards, Trail of Bits 2019-11-20
  8. No video On the Security of Copying To and From Live ContainersAriel Zelivansky & Yuval Avrahami, Palo Alto Networks 2019-11-20
  9. Knative - The Security Platypus?Ariel Shuper, Aqua Security 2019-11-20
  10. Binary Authorization in KubernetesAysylu Greenberg, Google & Liron Levin, Palo Alto Networks 2019-11-20
  11. Securing Communication Between Meshes and Beyond with SPIFFE FederationEvan Gilman, Scytale & Oliver Liu, Google 2019-11-21
  12. Prepare to Be Boarded! A Tale of Kubernetes, Plunder, and CryptobootyJames Condon, Lacework 2019-11-21
  13. Kubernetes Policy Enforcement Using OPA At Goldman SachsMiguel Uzcategui, Goldman Sachs & Tim Hinrichs, Styra 2019-11-21
  14. How Yelp Moved Security From the App to the Mesh with Envoy and OPADaniel Popescu, Yelp & Ben Plotnick, Cruise 2019-11-21
  15. How Kubernetes Components Communicate Securely in Your ClusterMaya Kaczorowski, Google 2019-11-21