Cloud Native Security Day 2021

13:55-14:05 CEST
Lightning Talk: Namespaces-as-a-Service with HNC and Kyverno! - Jim Bugwadia, Nirmata & Adrian Ludwin, Google
Kubernetes namespaces provide a strong security boundary and allow sharing cluster resources to reduce costs and increase efficiencies. However, enabling secure self-service namespaces is complex. In this session, Jim and Adrian from the Kubernetes Multi-Tenancy Working Group will demonstrate how the Hierarchical Namespace Controller (HNC) and Kyverno can be used together to enable “namespaces-as-a-service” for enterprise teams. First, Jim will show Kyverno how it can automate fine-grained permission management, enforce security, and generate default configurations. Next, Adrian will discuss how HNC makes it easy for developers to manage additional sub-namespaces without requiring cluster-admin privileges. They will then show a live demonstration of using the two CNCF projects together to enable self-service for namespaces without compromising security.

14:05-14:15 CEST
Lightning Talk: Securing CI/CD Infrastructure for Tinkerbell - David McKay, Equinix Metal
Tinkerbell, a CNCF sandbox project, has some pretty unique CI/CD needs. As a bare metal provisioning system, CI/CD involves running servers for DHCP, iPXE, virtual machines with QEMU, and a few others bits and pieces. This use-case is not natively supported by most CI/CD SaaS vendors. To tackle this, the Tinkerbell team has automated the management and provisioning of their own CI/CD runners using a collection of off-the-shelf tools. You will learn how Tinkerbell secured their unique infrastructure and how to approach securing your own CI/CD stack. We will demonstrate Tinkerbell’s provisioning tools and dive deep into how they were configured for security. The same tools are publicly available and could be used in your own CI/CD setups. You will also learn how to secure engineer access to your infrastructure without getting tied to a single cloud provider.

14:15-14:25 CEST
Lightning Talk: Challenges in Cloud Native Forensics - Andrew Krug, Datadog
As more companies have gone cloud native the focus on resilience has largely focused on detection and speedy recovery. These are only two tactics that should be in the defense toolbox. Forensics is a discipline that has arguably suffered as log volumes and DevOps culture has become more normative. In my session, I’ll demonstrate where the gaps exist and how the ecosystem could improve capabilities around the art of forensics.