►
From YouTube: IBM Sponsored Session - Protecting Kubernetes Workloads from Attacks - Chris Rosen, IBM
Description
Join us for Kubernetes Forums Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
IBM Sponsored Session - Protecting Kubernetes Workloads from Attacks - Chris Rosen, IBM
Innovation and speed require cloud tools to build, deploy, and run cloud-native workloads. But how do I protect those workloads and mitigate the risks of running those apps in the cloud? This demo showcases how you can easily isolate Kubernetes clusters to ensure outbound Internet traffic is routed through in-cluster virtual firewalls to protect your resources and intellectual property.
A
All
right
good
morning,
thanks
everyone,
my
name
is
Chris
Rosen
I've
got
a
very
tight
five-minute
time
line
that
I've
been
told,
I
need
to
adhere
to,
or
else
so.
What
we
want
to
do
is
quickly
kind
of
talk
through
something
that
is
not
a
new
story
to
anyone
in
this
room
at
least
I
assume
not,
and
that's
about
you
know,
being
able
to
run
workloads
and
being
aware
of
contacts.
A
Anyone
that
you
know
has
kids
in
that
age
group
of
playing
fortnight,
or
maybe
you
play
yourselves
you're
fully
aware
of
you
know
the
constant
attack
that
you're
under
as
well
as
the
time
stuck
that
that
game
turns
into
so
once
upon
a
time.
Think
about
as
a
developer,
I'm
sitting
down
and
I've
written
this
fantastic
idea
and
I've
scripted
up
and
I'm.
You
know
I'm
think
containers
and
micro
services
and
all
the
you
know
the
modern
technology
to
be
able
to
run
and
develop
this
new
application.
A
A
That
developer,
that
we
started
with
just
like
you,
just
like
the
entire
ecosystem,
has
chosen
kubernetes
as
that
container
or
customers
two
years
ago.
It
was
really
a
hot
discussion
over
which
type
of
orchestration
you
were
going
to
leverage
and
build
on
top
of
the
day,
clearly
kubernetes
and
all
the
benefits
that
are
inherent
to
it,
with
Auto
recovery
and
auto
scaling
and
deployments
load
balancing,
though
she's
chosen
that
right
so
now.
The
next
step
in
that
transformation
is
where
do
I
run
that
so
what
she
does
is
she
goes
and
she
talks
to
her.
A
She
puts
in
a
support
ticket
for
her
IT
team
and
he
says:
oh
well,
we
don't
have
kubernetes
cluster,
yet
I'm
really
busy.
You
know
rewiring
the
datacenter,
so
she's
hit
this
roadblock.
What
do
I
do
so?
She
comes
up
with
that
little
brain
baby
and
says
the
cloud
I
will
run
this
workload
in
the
cloud.
I
will
be
able
to
take
this
super-awesome
application
that
I
just
developed
run
it
in
the
cloud
all
been
here
before
her.
What
I
like
to
call
the
internal
mall
cops.
Some
people
may
not
like
that
affectionate
term.
A
As
much
and
think
of
security
or
your
seaso
does
no
we're
not
ready
to
run
that
you
can't
deploy
your
own
shadow
IT
and
start
running
workloads
cloud
now
there
are
a
number
of
managed
services,
not
only
an
IBM
cloud,
but
every
other
cloud
that
you
may
have
already
heard
of
jumping
onboard
with
kubernetes.
As
at
orchestration
platform,
though,
some
of
the
things
that
you'll
get
an
IBM,
you
know
around
simplified
deployment,
lifecycle
management,
integrated
operational
tools,
compute
isolation,
including
bare
metal.
A
It
was
she's
trying
to
think
about
how
do
I
run
that
application
and
how
do
I
move
it
to
the
cloud
and
do
so
in
a
secure
way.
So
out-of-the-box
kind
of
the
first
environment
is
I,
create
this
cluster
I've
got
my
Al
B's
I've
got
my
super
cool
new
application,
all
running
and
tane
Erised,
but
you
can
see
here.
Everything
is
fully
accessible
on
the
frontside
network
and
therefore
you
know
I
really
have
a
lot
of
risk.
I
have
a
large
attack
surface
for
all
of
my
worker
nodes
in
that
cluster.
A
Essentially,
what
we're
going
to
do
is
we're
going
to
go
through
we're
gonna
log
in
this
is
the
beautiful
shell
script
most
likely
you're
gonna
automate
this
with
terraform
or
some
other
automation
tool
of
your
choice
to
be
able
to
handle
all
of
this
lifecycle
management
so
essentially
we're
doing
first
we're
gonna
log
in
now.
The
next
step
is
we're
going
to
create
this
cluster
nice
long
lots
of
options,
things
that
you
figure
in
tweak
again-
probably
do
this
once,
but
then
you're
gonna
go
forward
and
automate
it
something
repeatable
and
auditable
with
careful.
A
Now
that
it's
deployed
I'm
gonna
go
through
and
I'm
gonna
actually
check
and
check
the
health
around
the
cluster
itself,
as
well
as
the
health
of
all
the
worker
nodes
that
are
running
inside
that
cluster
and
then
the
last
step,
for
that
we're
going
to
do
here
is
actually
deploy.
This
super
secret,
very
impressive
application
that
I
had
started
out
developing
on
my
laptop
now.
A
A
Well,
it
wasn't
that
great
of
an
app,
but
it
was
just
a
guestbook
app.
So
what
did
we
actually
do
out
of
all
of
that
that
command-line,
that
long
string
of
stuff,
essentially
what
we
did
is
create
a
kubernetes
cluster?
That
leverages
creates
three
different
worker
pools.
One
is
like
a
DMZ
where
I've
got
my
firewall.
A
I've
got
my
Gateway
all
of
my
traffic
routes
through
that,
then
I've
got
an
edge
worker
pool
where
my
application
load
balancers
reside
and
then
all
of
my
intellectual
property
is
running
down
here,
completely
segregated
an
air-gap
from
the
rest
of
the
outside
world.
When
we
look
at
you
know,
you
could
do
the
same
thing
in
the
UI.
If
you're
a
point,
click
love
pretty
pictures.
You
can
do
that
UI
as
well.
You
can
see
the
health
you
can
see.
A
The
three
different
worker
pools
that
I
had,
and
lastly,
is
that
we're
here
to
help
you
be
successful
in
that
transformation
that
journey
wherever
you
are
with
a
native
application,
development
or
app
modernization
running
it
and
a
managed
service
of
that
way.
You
focus
just
on
your
line
of
business,
but
with
that,
I
was
pretty
close
time
time.