Cloud Native
Security Talks
RSS

KubeCon North America 2024

CEL-Ebrating Simplicity: Mastering Kubernetes Policy Enforcement

Kevin Conner, Getup Cloud & Anish Ramasekar, Microsoft

Abstract

As Kubernetes deployments grow increasingly complex, robust policy enforcement is crucial. The Common Expression Language (CEL) provides a powerful solution, enabling the creation of sophisticated, human-readable expressions for Kubernetes policies. This session explores CEL’s integration with Kubernetes, simplifying policy definition and enforcement. Key takeaways: - Fundamentals of CEL and its Kubernetes integration. - Practical use cases for CEL in admission control, resource management, and security. - Enhancing policy expressiveness and flexibility with CEL. - Introduction to CEL Playground for testing and validating CEL expressions. Through live demos, learn to leverage CEL and CEL Playground for streamlined policy management in Kubernetes. Ideal for administrators, developers, and DevOps professionals, this session equips you to enhance your Kubernetes policies using CEL. Join us to discover how CEL and CEL Playground can transform your Kubernetes policy management.

More from KubeCon North America 2024

Open in the index →
  1. Workload Identity Federation – Stop Using Long-Lived CredentialsBenjamin Dronen, Ford Motor Company & Anjali Telang, Red Hat 2024-11-13
  2. GitOops... I Did It Again! Protecting Your GitOps System from Being Used for Privilege EscalationOreen Livni & Elad Pticha, Cycode 2024-11-13
  3. From Observability to Enforcement: Lessons Learned Implementing eBPF Runtime SecurityAnna Kapuścińska & Kornilios Kourtis, Isovalent 2024-11-13
  4. Expanding the Capabilities of Kubernetes Access ControlJimmy Zelinskie, authzed & Lucas Käldström, Upbound 2024-11-13
  5. Bridging Clouds: TikTok’s Blueprint for Unified OIDC Access on Multi-Cloud KubernetesNaveen Mogulla, TikTok 2024-11-13
  6. Breaking Free from Vulnerability Scanning Noise: Automated VEX Aggregation for AccuracyTeppei Fukuda, Aqua Security Software Ltd. 2024-11-13
  7. AuthZEN: The “OpenID Connect” for AuthorizationOmri Gazitt, Aserto 2024-11-13
  8. What Agent to Trust with Your K8s: Falco, Tetragon or KubeArmor?Henrik Rexed, Dynatrace 2024-11-14
  9. Multi-Tier Security in WasmCloud: From Developer Constraints to Platform ExtensibilityBrooks Townsend, Cosmonic 2024-11-14
  10. Mish-Mesh: Abusing the Service Mesh to Compromise Kubernetes EnvironmentsHillai Ben-Sasson & Nir Ohfeld, Wiz 2024-11-14
  11. It's Dangerous to Build It Alone, Take This.Jeremy Rickard & Ashna Mehrotra, Microsoft 2024-11-14
  12. From Standards to Practice: The Journey to Container MaturityCarmen Chow & Thomas Robinson, Yelp 2024-11-14
  13. From Silicon to Service: Ensuring Confidentiality in Serverless GPU Cloud FunctionsZvonko Kaiser, NVIDIA 2024-11-14
  14. Why Perfect Compliance Is the Enemy of Good Kubernetes SecurityMichele Chubirka, Google 2024-11-15
  15. The Policy Engines ShowdownGabriel L. Manor, Permit.io; Andres Aguiar, Okta; Omri Gazitt, Aserto; Pauline Jamin, Agicap; Tyler Schade, Geico; Joy Scharmen, StrongDM 2024-11-15
  16. Seccomp and eBPF; What’s the Difference? Why Do I Need to Know?Natalia Reka Ivanko & Duffie Cooley, Isovalent @ Cisco 2024-11-15
  17. SPIFFE the Easy Way: Universal X509 and JWT Identities Using cert-managerTim Ramlot & Ashley Davis, Venafi 2024-11-15
  18. SPIFFE Deployments in Non-Kubernetes EnvironmentsNadin El-Yabroudi & Eli Nesterov, SPIRL 2024-11-15
  19. Rogue No More: Securing Kubernetes with Node-Specific RestrictionsAnish Ramasekar, Microsoft & James Munnelly, Apple 2024-11-15
  20. Practical Supply Chain Security: Implementing SLSA Compliance from Build to RuntimeEnguerrand Allamel, Ledger 2024-11-15
  21. Powering Automatic Authorization in Envoy Through Live Traffic InspectionDom Del Nano, Pixie core maintainer 2024-11-15