►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Recent fallout from Kubernetes issues, like CVE-2018-1002105, expose the seriousness of API level vulnerability to data breaches and incidents. What should you do if an application on your K8s pod is compromised? We will talk about what DevOps best practices can help isolate, monitor, track, and apply control types that protect your organization.
A
All
right
we're
going
to
go
ahead
and
get
started.
I'd
like
to
thank
everyone.
Who's
joining
us
today.
Welcome
to
today's
CNC
at
webinar
tools
and
techniques,
securing
api's
in
kubernetes
environment,
I'm
chris
trans
cnc
have
ambassador
technologist
for
native
as
a
self-employed
person
and
I'll
be
moderating
today's
webinar.
We
would
like
to
welcome
our
presenter
today,
even
na'vi
coughs,
you
at
ball
arm
out
of
san
francisco
items
before
we
get
started
during
the
webinar.
You
are
not
able
to
talk
as
an
attendee,
but
there
is
a
Q&A
button
at
the
bottom
of
the
screen.
A
A
A
Hi
everybody,
my
name
is
Ivan
and
CEO
of
warm
my
doing
application
security
and
also
I'm
a
back
hunter
and
right
the
taker.
It
means
that
I'm,
a
practical
expert
and
application
security,
and
today
I'd
like
to
share
some
sort
of
experience
and,
like
application,
security,
related
aspects
of
kubernetes
environments.
So,
let's
start
with
best,
so
I
want
to
actually
explain
7.6
I,
don't
know
what
put
six
here,
nevermind,
so
619,
seven
points
we
need
to
take
to
build
secure
environment
kubernetes.
A
In
particular,
we
need
to
protect
our
data
right
and
the
data
that
should
be
perceived
by
apps
and
we
need
to
protect
entire
environment
and
then
take
care
about
the
application
security,
which
is
the
most
important
part
here,
because,
as
you
know,
so,
every
single
time
when
we
are
talking
about
data
breach
or
some
sort
of
like
security
incidents.
We
need
to
focus
on
this
entry
point
that
initial
initial,
like
issue
or
initial
vilandra
live
that
was
used
by
attacker.
A
But
I
want
to
present
everything
in
the
direction
to
explain
how
to
secure
and
how
to
build
a
security
environment
in
kubernetes
itself
and
then
to
explain
how
it
occurs
actually
may
use
that
issues
and
how
they
can
actually
steal
data
because
of
like
application,
security
issues
there.
So,
let's
start
with
namespaces,
so
first
of
all,
I
need
to
explain
why
we
need
to
build
everything
and
specifically
this
direction.
A
So
we
need
to
remember
that
we
want
to
protect
our
data
like
data
of
our
customers
in
our
orders
they
are
like
lost
in
first
names,
emails,
whatever
as
a
sense,
never
mind
which
kind
of
data
we
cannot
protect
environments,
apps
like
service,
something
else.
We
need
to
protect
exactly
data,
that's
why
we
need
to
figure
out
how,
like
which
kind
of
data
we
need
to
put
where
how
to
operate
to
this
data
before
we
will
try
to
isolate,
secured
changes.
A
Actually,
the
same
approach
was
built
like
years
ago
and
like
people
just
started
to
build
like
access
control
lists
for
networks
or
like
as
isolation
things
there,
we
need
to
start
with
the
data
all
the
time.
For
example,
if
I
have
like
a
pet
ties,
online
shop
I
need
to
take
care
about
my
user
data.
A
There
like
pets
data,
some
sort
of
like
kind
breed
data
burst
of
iPad,
whatever
cards
itself,
some
sort
of
like
current
state
of
orders,
items
in
their
prices
and
some
sort
of
marketing
things
like
banners,
flakes
I,
don't
know
webinars
or
whatever
so,
and
if
I
take
a
look
and
my
data.
So
it
will
be
a
little
bit
more
clear
for
me
how
to
divide
everything
by
that
kind
of
data
and
how
to
build
errors
around
that.
A
It
is
related
to
this,
like
my
grossest
approach
and
like
decentralized
functions
approach
as
well,
but
we
need
to
understand
that
service
is
kind
of
function
and
data
is
kind
of
like
the
data
behind
that
function.
That's
why
we
need
to
divide
everything
by
date
at
first,
where
before
we
will
answer
to
a
question
how
to
like
procedure,
data
by
different
functions,
so
it's
kind
of
like
a
basic
concept
but
for
some
reason,
for
some
reason,
people
actually
boil
in
that
all
the
time
so
and
making
mistakes.
A
When
we
talk
about
that,
we
all
the
time
will
be
faced
with
real
kernel
cases,
and
it
could
be
like
some
sort
of
like
Asian
things
like
memcache
the
registers.
They
need
to
part
everything,
because
we
need
to
make
our
operation
faster.
It
means
that
we
need
to
combine
every
single
like
piece
of
the
data
somehow
for
some
period
of
time
in
some
sort
of
temporary
storage,
and
it
means
that
will
break
our
isolation
there.
It's
kind
of
like
exception
there,
and
we
need
to
take
care
about
it
as
well.
A
A
But
we
need
to
think
about
that
and
we
need
to
build
our
environment
based
on
that
fact,
so
otherwise
anyways
we
will
never
build
anything
better
than
like
random
random
isolation,
so
acadec
show
su
plus
we
have
front-end
service
and
in
fact
ago
it
means
that
if
somebody
were
able
to
find
like
a
client-side
back
back
in
your
application
and
explode
that
back,
so
that
person
will
able
to
take
an
access
to
all
the
data,
because
technically
the
website
will
take
all
the
data.
Login
passwords,
I,
don't
know
like
everything
else
there.
A
It's
also
a
kind
of
like
an
exception
from
that.
Like
idea
of
world,
when
all
the
data
could
be
isolated
between
by
different
logic,
logical
parts,
but
we
need
to
think
about
that
and
we
need
to
try
to
divide
everything
at
specifically
a
data
layer.
So,
let's
start
with
namespaces,
as
I
said
before,
we
will
pass
through
the
seven
stages
and
we
need
to
do
it
in
specifically
this
direction,
because
everything
who
will
describe
later
almost
everything
there
will
be
based
on
some
sort
of
like
previous
steps
right
so
idea
of
namespaces
in
kubernetes.
A
It's
it's
pretty.
Like
usual
thing,
I
believe
that
you
heard
about
that
already.
An
idea
here
is
to
divide
faster
to
a
few
virtual
clusters.
So
if
you
are
in
a
tech
for
a
while,
it
seems
like
virtual
casts
for
under
the
roof
of
like
and
the
hood
of
like
one
main
host.
So
as
it
was
always
like
hustling
providers
for
like
25
years
ago,
the
same
idea
but
applied
to
clusters,
kubernetes
clusters,
how
to
split
them
by
virtual
clusters,
and
one
useful
quote
from
from
official
kubernetes
Doc's
I
need
to
mention
here.
A
As
so
kubernetes
does
not
provide
a
mechanism
to
enforce
security
across
namespaces.
You
should
do
that
by
yourself.
It
means-
and
you
should
only
use
it
within
trusted,
domains
and
not
use
when
you
need
to
be
able
to
provide
guarantees
that
the
user
of
the
cluster
or
port
being
able
to
access
any
of
other
namespaces
our
resources.
A
So
you
it
means
that
this
is
kind
of
like
a
logical
thing
right,
so
you
can
apply
namespaces
to
do
something
else,
based
on
that
isolation,
network
security,
whatever
it
means
that's
why
we
need
to
start
specifically
from
namespaces
before
with
the
row
based
networks,
part
whatever
so,
and
by
number
two.
What
is
really
unique
about
that
and
what
is
bad
actually
about
the
namespaces
namespace
is
just
kind
of
list.
You
cannot
create
a
hierarchy
of
that.
You
cannot
put
one
namespace
as
a
child
of
other
namespace
apparent
namespace.
A
You
probably
want
to
do
that,
but
you
cannot,
but
we
can
do
some
hacks
and
actually
it's
pretty
usual
eggs,
implemented
by
almost
everybody
who
built
production,
ready
environments
based
on
queue
so
and
the
hack
here,
as
we
can
use
some
sort
of
preferences
we
can
define
our
own
schema,
like
name
schema,
how
to
build,
how
to
define
namespaces
in
our
own
way
and
use
that
to
actually
put
different
attributes
there.
So,
for
example,
it
could
be
team,
name
and
environment
name
and
all
something
like
that.
A
But
since
I
already
suggested
to
use
this
type
data
based
approach,
we
can
also
put
a
kind
of
data
inside
that
namespace
name
and
then
like
splitted
by
or
I
it's
impossible
to
use
bye-bye
character
or
other
characters.
We
can
use
there.
So,
for
example,
I
want
to
suggest
to
use
this
first
datum
staging,
for
example,
to
define
a
namespace
that
specifically
address
all
the
personal
data
at
staging
environment
or
like
PCI.
A
This
is
early
data
and
production
environment,
so
it
can
help
us
later
to
build
everything
based
on
that
and
to
apply
access
controls
to
apply
different
policies
based
on
that
and
technically
it
means
that
we're
doing
attributes
right
so
kind
of
data
is
an
attribute.
Their
environment
name
is
a
kind
of
attribute
there.
A
We
can
add
more
attributes
adding
the
added
death
here
by
the
same
thing
right,
and
it
means
that
so
technically,
it
means
that
we
want
to
build
a
kind
of
like
basis
to
apply
as
a
mechanism
based
on
some
sort
of
attributes,
and
this
is
an
interest.
In
fact,
there
alyx
play
explain
later
what
exactly
we
can
build.
Based
on
that,
so
a
couple
of
links
you
can
use
to
understand
that
things
better
and
actually
I
want
to
give
you
as
many
like
receipts
as
I.
Only
can
so
I
mean
valuable
receives.
A
We
can
use
out
of
the
box
to
build
that.
This
is
really
if
you
can
use
to
understand
better
how
to
work
with
namespaces,
how
to
define
the
namespaces
and
different
use
cases
and
insights
from
from
Google.
Actually.
So
if
you
have
any
questions
related
to
namespaces
and
specifically
that
idea
to
put
that
prefixes,
let's
let's
discard
that
and
then
we
will
switch
to
Rome
based
model.
Do
you
have
any
questions
there.
A
Doesn't
look
like
there
are
any
questions
which
is
good,
which
is
good,
so
I
mean
it's
a
usual
thing
there
right,
so
I
believe
that
when
you
just
want
to
start
with
talk
with
kubernetes,
you
just
need
to
go
through
that.
So
second
one
is
a
role
based
model.
So
what
would
I
did
before
with
the
namespaces,
which
technically
mentioned
that
attributes
based
ink
right?
A
So
and
but
we
want
to
explain
role
based
model,
not
attribute
based
model,
because,
as
we
can
see
at
a
Google
official
site
and
kubernetes
dark
ABC,
which
means
like
attribute
based
access
control,
it's
a
powerful
concept,
however,
as
implemented
in
kubernetes
ABC
is
difficult
to
manage
and
understand,
requires
an
association
rule
file,
access
to
a
master
of
VM
of
the
cluster,
to
make
a
cessation
policy
changes,
and
so
it's
and
for
permission,
changes
to
take
effect
across
the
API.
It
must
be
restarted,
which
is
like
non
useful
way.
That's
why?
A
When
we're
talking
about
like
role
based
access,
control,
only
were
talking
about
like
access
control,
we're
talking
about
like
RBC
instead
of
ABC,
but
what
we
actually
be
here.
We
put
some
sort
of
attributes
right
and
namespaces,
and
nowadays
we
can
use
the
same
thing
to
apply
some
sort
of
like
attributes
in
air
BAC.
So
we
did
that
specifically
to
bypass
that
like
use
less
ADHD
model
and
kubernetes.
So
let's
break
it
down
the
core
idea
as
it's
a
whitelist
family,
it
means
that
everything
that
we
never
listed
will
be
denied.
A
So
it's
based
on
three
things.
Subject:
results
and
operation
so
subject
it's
like
who,
like
developer,
devups,
I,
didn't
team
member
user
process,
whatever
resource
as
like,
with
which
kind
of
object,
bipod
or
service
or
cluster
itself,
or
as
logic,
instances
related
to
kubernetes
and
operation,
their
main
site,
which
kind
of
action
we
want
to
allow
to
do
it's
technically
related
to
rest
method.
It
could
be
like
you
or
like
modifications
they
released
whatever
so,
and
a
cluster
role
is
additional
object
here,
Everson
actually
related
to
your
BC,
based
on
two
main
objects.
A
It's
a
role
plus
cluster.
Oh
we
described
before
and
plus
the
role
is
the
same
as
roll
plus.
It
allows
you
to
give
permissions
for
additional
things
like
non
namespace
resources,
like
notes
that
we
can
actually
avoid
to
do
because
ever
since
there
should
be
covered
by
namespaces
I
mean
everything
we
made
with
kubernetes
a
resources
and
all
the
namespaces
of
a
cluster.
A
We
need
to
avoid
that
as
well
and
never
try
to
allow
somebody
to
deal
with
all
the
namespaces,
because
when
you
will
do
this
wildcard
one
day,
if
somebody
will
make
a
mistake
and
create
another
one
namespace
outside
of
the
thing
I'll
cover
that
case
later.
This
is
a
particular
soil.
Take
a
nexus
on
that
as
well.
A
It
shouldn't
be
there,
just
least
only
that
namespaces
you
want
to
create
and
avoid
ever
since
the
rest
so
and
non
resource
things
like
built,
an
endpoint
such
as
house
or
other
things
there,
which
is
definitely
useful
for
key
boxes
and
operations,
guys
so
the
main
idea
I,
guess
that
you
know
that
so
how
to
implement
that
to
our
a
bag
concept.
So
actually,
the
heck
here
is
to,
as
I
said
before,
to
build
some
sort
of
light
attribute
based
controls
using
that
ABC
roll
based
concept
of
kubernetes.
A
We
can
use
that
by
namespaces,
for
example.
We
can
use
that
context
here
and
define
some
sort
of
security,
can
contact
context
and
use
pay
a
namespace
like
first
data
prot
and
define
a
user
first
data
proud
reader
and
means
that
that
particular
user
will
be
labeled
to
read
personal
data
at
production,
and
so
we
we
can
take
care
about
that
privileges
and,
in
this
case,
work
which
will
be
pretty
understandable
to
a
pretty
visible
parts
and
for
all
the
other
folks
about
working
fast.
A
It
will
be
related
to
specific
context
and
we
can
use
the
same
context
to
apply
different,
like
access
controls
like
at
work,
security,
for
example,
or
security.
Based
on
that.
So
that's
why
I
want
to
explain
that
case
as
actually
it's
a
reference
design
of
every
single
both
before
and
kubernetes
in
our
own
company.
A
But
if
you
know
how
to
I
mean
extend
that
just
let
me
know
+
ants
again,
you
can
add
as
many
attributes
there
as
you
want
to
explain,
namespaces
weather
and
to
then
build
by
this
attribute
based
access
controls
better
than
in
this
simple
case.
So,
if
I
have
any
questions
related
to
role
based
model,
just
let
me
know-
and
here
you
can
find
a
couple
of
things
related
to
role
made
a
strange
thing.
A
I'm
sorry
I
said
there
is
one
question
sure
from
before
that:
how
do
you
enforce
namespace
rules,
I
think
part,
or
actually
they
aren't
that
already?
But
if
you
want
to
elaborate
on
that
a
little
now,
let
me
open
the
question.
I
am
Not
sure
that
I
have
you.
It
is.
How
do
you
enforce
namespace
I
got
it
yeah.
Okay,
see
I'll
cover
that
later.
We
need
to
enforce
not
only
namespaces
policies
too,
but
also
all
the
other
things.
A
We
need
to
do
there
because
kubernetes
in
this
case
is
just
kind
of
framework,
and
you
can
build
everything
based
on
the
framework
and
a
little
bit
later.
I'll
explain:
I,
have
an
additional
slightly
special
slide
to
explain
how
we
can
keep
everything
under
control
and
enforced
ever
since
they're,
so
we
can
use
open
source
tools
and
so
I'll
explain
a
couple
of
them
at
the
last
part
of
my
webinar
today.
A
So
I'll
cover
that
later,
it's
not
related
only
for
namespaces
enforcement
and
also
related
to
ever
since
arrests
like
a
role
based
as
well
right.
So
you
need
to
enforce
that
first
data
prod
reader
like
notation
right,
so
you
can
not
avoid
that
you
can
define
ever
since
you're
like
you,
can
make
a
mistake
here
and
type
like
press
data
instead
of
first
data
right,
it
shouldn't
be
there.
So
I'll
explain
a
little
bit
later
how
to
how
to
control
that
once
again,
kubernetes
is
not
in
terms
of
like
this
application.
A
A
In
the
right
way,
so
we
just
took
an
skin.
Kubernetes
is
a
kind
of
like
framework
here,
so
you
can
define
everything
based
on
this,
like
role
based
model
and
kubernetes,
well,
just
implement
everything
that
we
will
define.
So
if
you
want
to
like
a
boy,
something
or
I
don't
know,
I
provide
any
more
things
there.
You
can
define
that
at
that
llamo
files
and
kubernetes
will
implement
that.
So
units
itself
will
not
do
anything
related
to
you
to
to
your
roles
for
right.
A
A
Since
I
mean
it's
not
associated
anyhow,
so
we
need
to
create
that
associations.
That's
why
we're
using
that.
So
we
want
to
create.
So
we
can
create
actually
our
own
notation
here
to
associate
that
and
then
we
need
to
define
all
the
context
as
to
to
to
create
these
links.
So
it's
a
kind
of
hack
how
we
can
dissociate
that.
A
Okay,
okay,
so
let's
proceed
with
network
policies,
then
so
a
couple
of
quotes
as
usual
from
from
kubernetes
official
Docs,
so
code
number
one
that
by
default,
ports
are
not
isolated,
so
it
means
that
they
traffic,
they
accept
predict
from
any
source.
So
and
second
code
here
is
like
only
ons.
There
is
another
policy
in
the
namespace
select
an
particle
path.
That
port
will
reject
any
connection
that
are
not
allowed
by
a
network
policy
which
is
good.
A
So
it
means
that
if
you
just
start
to
declare
network
policy,
you
can
be
sure
that
ever
since
the
rest
will
be
rejected
soon,
you
don't
need
to
take
care
of
it.
So
it
means
in
particles
that
other
parts
in
the
namespace
that
are
not
selected
by
Network
policy,
look
and
intercept
the
traffic.
So
it
means
for
us
that
we
need
to
apply
a
network
policy
to
cover
everything.
If
we
will
miss
something
so
that
parts
will
accept
any
connections
which
is
by
fast
and
unciekin
to
guarantees
that
we
covered
everything
by
network
policy.
A
We
need
to
implement
some
sort
of
enforcement's
there
and
to
do
that,
we
need
to
use
some
sort
of
tools.
That's
only
one
way
how
we
can
do
that
in
particular.
It
means
that
we
need
to
apply
some
sort
of
light
filters
to
to
our
yellow
files
can
see
files
there
and
check
that.
So
that's
only
one
way
how
we
can
enforce
anything
and
kubernetes,
but
a
little
bit
later
explained
with
with
which
kind
of
tools
we
can
do
that
so
plus
we
need
to
man.
A
We
need
to
remember
that
we
need
to
disable
meter
data
like
API
metadata,
it's
technically,
it's
you
see
be
provided
by
your
GCP
or
AWS
access
from
all
the
parts
to
prevent
lockout,
exploitations
or
server-side
issues.
It
could
be
like
an
SSRI
that
could
be
removed
at
execution
issues
or
whatever.
So
it's
a
lot
of
issues
at
application.
Security
level
that
allows
a
taker
to
send
requests
to
internet
may
also
affect
that
things.
That's
why
we
need
to
disable
the
access.
A
Seven
point
number
two:
we
shouldn't
forget
to
restrict
access
to
kubernetes
services
like
this
book
and
pro
panels
and
others,
and
so
a
little
bit
later.
Actually
right
now,
I
want
to
explain
two
different
cases:
two
different
stories
that
happen
with
companies
who
means
that
since
third
number
ones
related
to
Shopify.
So
in
this
particular
case,
actually
one
folk
at
Hager
wan-soo,
which
is
kind
of
like
a
platform
that
allows
by
bounders
to
stand
a
vulnerability
reports
to
vendors
and
achieve
some
sort
of
like
compensation
for
that
from
them.
A
So
he
create
a
store,
Shopify
his
own
store
and
then
modified
team
played
and
had
some
some
sort
of
JavaScript
there
to
open
a
new
window
at
server
side
so
ends
again.
Did
that
file
actually
rendered
at
server
side,
not
under
the
browser
and
put
emitter
data
API
zero
and
achieve
back
some
sort
of
results
from
coop
from
kubernetes
cluster
of
Shopify
and
use
that
to
to
steal
their
keys
and
credentials
tokens
from
a
cluster
itself
and
in
fact
compromised
the
entire
cluster.
A
So
in
particular,
it
mean
that
he
was
able
to
run
any
code
with
the
root
privileges
at
which
single
pod
at
every
single
instance
there,
which
is
definitely
a
bad
thing
just
by
using
that
Assessor
effort,
ACK
and
so
ever
since
there
was
based
on
the
application
security
syncs.
Definitely
so
you
need
to
take
care
about
this
metadata
API
if
you
using
kubernetes
at
Google
to
redouble
years
or
whatever.
Otherwise
you
need
to
care.
Take
care
about
you,
your
own,
like
etcd,
place
somewhere
else
so
case
number
two
here
as
a
Tesla
case.
A
So
it's
more
actually
usual
situation
than
this
one,
because
in
this
case
you
need
to
know
how
to
cook
that
application
server
side
issue
like
as
a
Sarah
in
this
case.
So
you
just
need
to
find
that
so
somebody
just
found
Tesla
kubernetes
instance
place
somewhere
and
login
they're
using
just
default
credentials.
It
was
just
an
unsecured
administrative
console
so
and
as
a
result
of
that,
so
that
person
compromised
and
tired
test
infrastructure,
where's
a
lot
of
data
are
related
to
telematics
and
others.
A
But
we
don't
know
what
exactly
was
compromised
there
at
they
mentioned
least
telemetric
data
means
all
the
data
with
the
tracks
and
routes
from
every
single
car
of
Tesla,
including
like
your
own
car
seat,
which
is
bad,
but
this
one.
Actually,
this
issue
mainly
related
to
like
very
old-fashioned
network
security,
access
control,
scenes,
plus
some
sort
of
like
kubernetes,
mid
configuration
plus
default
secrets,
and
this
one
is
related
to
something
more
unusual
applications.
A
You
could
get
things
and
it's
related
to
also
to
that
fact
that
you
can
technically
around
your
own
code
at
your
shopify
instances
to
make
it
like
ecommerce
plates
on
mikaze.
So
that's
why
this
issue
happens
there.
So,
if
you
have
any
questions
related
to
network
policies,
it's
really
time
to
read
that
otherwise
I'll
keep
going
and
final
to
finally
explain
application
security
aspects
of
api's,
because
nowadays
we
still
work
in
this
platform.
So
there
are
two
questions.
A
Yes,
yes,
we
can
do
that,
so
we
can
do
that
name,
selector
name
selector
and
a
box
electrofield,
but
I
guess
that
the
best
practice
here
is
to
apply
that
enforcement
policies
to
to
avoid
like
as
that
requirement,
but
yeah.
We
can
do
that
so
and
question
number
two
yeah
best
way
to
restrict
access
to
the
metadata
API,
since
network
policy
is
the
namespace
resource
and
namespace
credentials
are
usually
shared
with
the
developer,
CI,
CD
and
so
on.
That's
probably
not
a
good
idea.
A
So
actually,
network
policy,
as
is
the
best
ways
there,
so
even
if
it's
shared
so
with
developers
so
nevermind,
so
they
will
know
that
we
respected
access.
You
can
also
implement
like
some
sort
of
like
a
castration
things
like
I
variable
0
or
so
you
can
also
configure
that
at
your
etcd
conflict,
but
if
you
doing
with
this
metadata
API
so
technically
so
cloud
providers
as
I
believe
already
restricted
that
could
you
recommend
net
asset
Tillet
deterrence
ACD
chain
to
check
that
on
other
policies
and
selector
parts
in
place?
Modified?
Yes,
I'll!
A
Ok,
that
seems
to
be
it.
So
let's
go
to
wonderful,
so
number,
four,
it's
a
pod
security
policy,
so
sorry
about
it.
I
know
that
it's
kind
of
usual
stuff,
but
I
just
want
to
share
some
insights
and
new
ideas
here
and
then
our
application
security,
which
is
breaking
mixer
pod
security,
is
pretty
interesting
stuff
here,
I
love
them
I,
mean
first
of
all,
at
some
sort
of
like
object,
define
a
set
of
condition
that
pod
must
run
in
order
to
accept
into
the
system
as
well
as
defaults
for
the
related
field.
A
I
do
not
understand
that
I
mean
from
my
point
of
view
that
pod
security
is
kind
of
like
all-in-one
and
point
security
management
policies
that
includes
selinux
app
armour
file
system
restrictions,
docker
things
like
privileged
containers
like
C
CTL
blacklist,
plus
a
comp
which
is
kind
of
sandbox
there,
plus
additional
other
things
added
by
Google.
It's
something
like
like,
for
example,
you
can
like
spend
a
year
to
understand
how
to
cook
a
Selina,
and
here
just
about
security
policies.
A
I
mean
they
did
a
really
good
job
to
like
pack,
everything
together
to
one
like
part,
security
palace
and
say
you
to
understand
that
I
mean
to
understand
how
its
really
work
inside.
You
need
to
understand
everything
here:
file
system
in
details.
The
gerson
can
details,
sis
controls
there,
SEC
comm
Salinas
and
their
partner,
it's
just
impossible
to
explain
what's
under
the
root,
but
I
can
explain
four
things
specifically
made
for
kubernetes
by
Google.
First
of
all,
it's
a
dog
related
sync,
it's
a
privileged
container.
A
Technically,
it
means
that
if
you
can
do
that
with
your
pot,
you
put
will
not
able
to
take
and
exit
back
to
the
heart
technically
their
devices
and
network.
So
specifically
it
it
enabled
by
default,
and
it's
really
good.
So
specifically,
it
means
that
you
can
prevent
some
sort
of
like
local
privilege,
exploits
that
allows
docker
containers
to
compromise
the
heart
plus
additional
things
there.
So,
as
well
as
like
a
blog
devices
and
other
devices
that
could
be
actually
used
inside
the
containers
there,
it's
a
good
option,
their
main
related
to
Becker
number
two.
A
Here
it's
just
a
route
like
read-only
root,
filesystem,
which
is
good
as
well
its
main
related
to
like
that
fact
that
so
you
can
do
that
it
like
a
graph,
for
example,
if
you
don't
like
all
the
Linux
or
so
it
allows
you
to
you,
protect
some
sort
of
data
on
on
your
apps
on
your
pots,
based
on
just
read,
only
file
access
rights,
you
cannot
put
shelter
or
some
other
malicious
things
there,
which
is
good.
Plus.
A
You
need
to
count
that
you
need
to
create
a
temporary
file
system
or
Cir
which
will
actually
allow
you
to
write
files
anyways
so
must
run
as
non-root
option.
This
is
some
sort
of
like
truth
of
jail
things.
Everything
inside
a
part
should
be
launched
as
and
enroute,
which
is
good,
so
it's
definitely
a
usable
things
there
and
if
you
can
build
you
a
infrastructure
based
on
that
and
you
can
deliver
apps
in
this
way,
it
will
be
super
helpful
to
avoid
post
exploitation
plus.
A
The
last
thing
here
is
a
lot
of
premature
escalation,
so
you
can
set
false
here.
It
means
that
child
process
can
take
more
privileges-
parent,
for
example.
You
cannot
use
fight
until
it
is
like
pink
or
as
it
will
just
with
sticky
bits
from
unprivileged
users,
so
it
also
allows
you
to
keep
against
post
exploitation,
sometimes
plus.
You
can
also
disable
just
using
that
privilege
that
it
is
from
from
your
apps,
which
is
beautiful
stuff
but
unciekin.
It's
just
only
for
features
implemented
by
google
plus.
A
You
can
control
entire,
a
selenium,
peripera,
more
file
system,
things
and
blacklist
for
sis
controls,
which
is
I
mean,
which
is
huge.
It's
just
impossible
to
explain
part
security
policies
in
detail,
because
to
do
that,
I
need
to
explain
this.
This
is
this
and
all
the
stops
there.
That's
why
I
just
want
to
mention
four
things
there
and
recommend
you
to
use
all
of
them
plus
take
care
about
usual
things:
I
guess
a
Linux.
A
It's
actually
a
good
example
why
we
can
say:
okay
I'm
using
my
containers,
I,
don't
take
care
about,
like
my
apps,
as
I
did
before,
with
SELinux
or
other
like
oscillation
of
sandbox.
It's
no.
You
should
do
that
as
well
as
it
was
before,
but
nowadays
you
can
control
that
using
that
part
security
policies
to
implement
additional
features,
plus
it
can
guarantee
like
a
better
migration.
A
If
you
did
that
during
things
before
we
can
run
the
same
stuff
and
kubernetes,
so
that's
it
so
four
different
links
related
to
that
once
again,
so
the
security
context,
you
can
define
to
use
pod
policies
there
Plus
this
link
number
two
is
very
useful
to
like
put
some
to
understand
that
for
things
but
put
some
more
things.
There
plus
kubernetes
dock
is
pretty
good
and
they
described
every
since
they're
buttons
again
to
be
able
to
cook
this
pod
policies
in
the
right
way.
A
A
You
can
stop
breaches
in
real
time,
using
like
all
these
policies
and
some
sort
of
prevention
tools
as
well,
so
two
different
things
here,
it's
stages
and
levels.
So
you
know
that
it's
no
birthing
here,
but
anyway
so
stages.
It
means
that
at
which
stage
that
particular
the
pretty
cool
at
which
at
which
stage
of
request
partition
that
kubernetes
side,
that
particular
event
will
be
triggered.
A
You
can
do
request
received
right
after
that
fact,
when
you
receive
the
request
response
started
and
it
just
started
to
send
every
response
response
complete
and
the
response
body
has
been
completed
at
service
and
panic
event
generated
when
the
panic
occurs.
It
means
it's
more
related
to
different
errors,
and
you
can
count
that
it's
like
five
hundred,
for
example,
responses
or
so,
and
you
can
do
different
levels
known,
which
is
don't
event,
don't
blog
event
that
might
the
true
metadata
local
quest
metadata
request.
A
It
means
log
event,
made
a
data
and
request
body,
but
not
response
body
and
requires
a
response.
It
means
that
you've
a
lot
ever
since,
if
you
can
log
everything
just
do
that,
you
will
actually
understand
what
what
what
happens
there,
but
I
actually
want
to
recommend
you
to
store
like
at
least
couple
of
days
in
request/response
way,
if
you
can
do
more,
plus
everything
the
rest
as
a
metadata
request.
A
So
you
can
configure
different
timings
were
different,
like
log
levels,
which
can
help
you
to
understand
your
risks
plus
deal
wealth
errors
and
deals
with
incidents
with
shorter
period
of
time,
but
was
detailed
data
inside.
So
what
I
want
to
recommend
here
so
kubernetes
and
I
mean
Google
that
really
good
job
to
put
a
lot
of
notations
and
a
lot
of
insights.
How
to
build
locks
in
the
right
way.
Just
use
the
same
way
to
allow
your
own
api's
and
application
lock.
A
If
you
will
do
that,
you
were
able
to
achieve
like
unified,
lock
systems
there.
So
it's
not
a
big
deal
to
ask
your
developers
and
trade
locks
based
on
your
custom,
business
logic,
locks
or
otherwise.
You
want
to
try.
You
want
to
keep
their
at
the
same
way.
If
you
don't
do
that,
people
able
to
easily
track
correlate,
manage
them
together
and
then
inside
here
is
like
try
to
be
as
much
closer
to
original
kubernetes
block
format
as
you
on
the
cam
in
your
apps
as
well.
A
So
and
put
them
together
like
do
the
same,
like
stages,
do
the
same
levels
there.
So
since
kubernetes
itself
is
just
a
web
app,
you
can
apply
an
API
right,
so
you
can
apply
the
same
model
of
the
oldest
policy
and
block
format
there
to
your
abs
as
well,
and
it
definitely
can
helps
so
that's
only
one
thing:
I
need
to
mention
log
everything
you
can.
A
If
you
have
know
an
app
of
storage,
do
different
period
of
times
do
like
request
response
for
a
relatively
short
period
and
request
there
to
store
more
data
there
and
metadata
for
all
the
other
logs
for
a
years
example.
So
if
you
can't
actually
store
everything
in
a
whole
couple
of
links
here,
so
I
definitely
recommend
you
to
read
the
last
one.
It's
a
personal
blog
of
the
guy,
no
cubes.
A
A
A
A
So
definitely
all
the
time
when
you
want,
when
your
cluster
will
deploy
report,
for
example
or
sir
you
ever
since
there
will
be
log
it
if
you
want
to
apply
more,
for
example,
if
using
custom,
say
city
sinks
and
you
you
example
deploying
like
I,
don't
know
your
own
apps
and
then
doing
some
kind
of
actions
there,
and
we
would
want
to
deploy
that
actions.
We
want
to
log
that
actions.
A
You
need
to
log
it
by
yourself,
but
in
general
case,
so
you
just
can
use
that
locks
and
should
be
enough
plus,
if
you
implement
it,
every
sin
during
the
deployment
stage
deployment
stage
in
right
way
ever
since
there
would
be
like
it
so
just
avoid
custom
scripts
there
and
use
like
a
general
deployment
model.
Actually
it's
a
little
bit
like
it
will
be
I
required
a
little
bit
more
than
like
30
minutes
to
explain
how
to
deploy
apps
and
kubernetes.
A
A
But
usually
people
didn't
like
that
very
lock,
which
is
kind
of
like
an
open
source
log
storage,
but
you
can
use
also
like
commercial
services
or
I
own
way
to
store
that
it's
really
a
benefit
if
it's
just
additional
costs
or
upgrade
out
there
if
you're
using
cloud,
so
you
can
just
buy
that
so
is
there
and
connected
zero
and
everything
will
be
there,
an
Amazon
or
Asia
or
Google
pal.
Okay,
let's
do
part
number
six
we're
almost
there
Prudential
diminisher.
A
For
all
the
people
in
the
audience,
please
do
put
the
questions
into
the
Q&A
sections
because
of
we
can't
do
everything
in
chat
and
I
will
probably
oversee
things
so
Q&A
box,
not
it
okay,
so
for
another
six
credentials
management
policy.
So
this
something
that
you'd
need
to
do
by
yourself.
Kubernetes
will
never
help
you
with
that.
So
kubernetes
will
provide
you
a
lot
of
like
capabilities
there.
You
can
use
Harkins
like
open,
ID
things
or
certificates,
I
prefer
to
recommend
certificates,
only
policies.
A
It
means
that
you
need
to
issue
a
certificate
for
every
single
operation.
You
need
to
do
there
put
some
dates
there
at
8:30
tickets.
In
this
case,
we
can
achieve
three
important
results.
First
of
all,
we
can
use
any
public
key
infrastructure
management
tools
and
products.
The
two
many
other
GTV
case,
which
is
like
old-fashioned
staff,
a
lot
of
products
there
were
invented.
A
You
can
use
them
and
connect
it
to
your
IBM
or
still
ever
since
they
are
already
solved
so
which
I
can't
say
about
like
there's
a
key
management
stuff
I
mean
talk
and
management,
stop
cos.
Somebody
can
just
copy
the
stock
and
forget
the
talkin
Samba
somewhere
I
put
it
attack
into
github,
which
we
need
to
improve
that
from
a
security
side,
and
we
will
do
that
in
future.
Definitely,
but
nowadays,
just
more
much
easy
to
use
public
in
things
and
issues.
A
Pivot
is
where
every
single
action
there
point
number
two
here:
that
tickets
on
the
way
will
allow
us
to
control
that
heard
of
times
right
so
because
you
cannot
issue
certificate
without
like
expiration
dates
and-
and
that's
though
so
you
can
put
expiration
dates
there
and
you
were
able
to
guarantees
that
the
city
will
not
be
valid
after
that
date,
which
is
also
better
than
just
like
a
plane
in
plain
text,
token
or
secret.
So
plus
you
can
use
object,
IDs
for
additional
attribute,
based
features
as
leverage.
A
You
can
apply
additional
logic
there
in
future
can
connect
it
ions
again
to
your
ID
on
our
life.
Idm
seems
we
can
do
groups
here.
Based
on
that
fact,
you
can
do
a
lot
of
things
based
on
that
GDP.
That's
why
I
recommend
to
use
that
plus
it's
just
not
as
easy
as
it
was
with
tokens
to
just
copy
and
paste
the
certificate
content
somewhere,
any
private
key
content
certificates,
the
public
informations
there,
which
is
good,
but
you
can
store
it
better.
A
So
a
lot
of
benefits,
then
I
know
that
it
seems
like
all
section
way
and
all
that
people
would
like
to
use
something
easier
than
certificates,
but
I
highly
recommend
to
use
that.
Because
of
the
three
points
we
will
never
achieve
using
any
anything
else
there
plus
you
can
do
it
for
not
only
infrastructure
credentials,
but
also
for
all
the
services
to
make
everything
in
one
unified
way.
A
I
know
that
this
unit,
this
kind
of
like
an
ideal
world,
for
example,
using
one
day
you
will
be
faced
with
an
integrationist
custom
API
of
like
so
the
party
provider
with
no
certificates
outs
indications
there,
but
use
that
as
like
frequent
as
it
only
possible.
Plus
we
can
do
another
once
in
here.
As
an
encryption
native
support,
kubernetes
seems
like
a
couple
of
versions
ago,
introduced
new
feature
called
native
encryption
support.
You
can
encrypt
your
tokens
as
it's
sort
and
add
VT,
CD,
plus
all
the
other
data.
A
If
you
want
to
do
that,
and
so
it
there's
something
like
kind
of
like
it's
not
a
better
version,
but
then
never
have
that
people
use
that
pretty
badly.
But
you
can
try
and
if
you
want
to,
you,
can
again
follow
that
link
and
understand
how
it
works
there.
And
in
fact,
so
you
can
just
define
that
you
want
to
encrypt
the
data
and
store
key
somehow,
but
I
don't
like
that
way,
because
actually
that
Keys
will
be
stored
at
the
same,
like
storage
chest
encrypted
data,
which
I
can't
accept.
A
So
do
you
have
any
questions
related
to
this?
I
can't
actually
recommend
some
sort
of
best
practice
instead
of
using
the
speaker,
management
tools
and
certificates
on
the
access
policy
class,
rotate
that
in
the
right
way,
and
to
do
that
it's
better
way
to
implement
certificates,
only
access
policies
there.
A
But
it's
something
that
you
need
to
decide
by
yourself:
how
to
implement
it
in
the
right
way
and
definitely
ID
and
providers
can
help
you
that
you
need
to
understand
like
on
which,
like
main
things,
your
credential
management
policy
will
be
based
on
I
want
to
recommend
certificates
only
like
basics,
but
it
should
no
question
yes
cool.
So
the
last
part,
and
the
most
interesting
part
with
the
store,
is
how
it's
relevant
to
application
security.
So
we
describe
six
stages
here
right.
A
We
described
a
lot
of
things
how
to
like,
protect
this
kubernetes
cloud
itself,
and
nowadays
I
want
to
explain
how
to
how
to
relevant
actually
to
the
application
security.
We
can
divide
all
the
application,
security
or
application
specific
vulnerabilities,
in
particular
to
two
different
things,
to
two
different
parts,
so
beside
things
that
can
how
the
takers
to
get
an
access
to
ports
and
client-side
things
that
I
can
help
them
to
take
an
exit
to
user
data.
So
if
we
did
everything
right
and
like
finds
106,
so
definitely
we
can
mitigate
this
risk.
A
A
Technically,
how
did
policies
may
help
to
identify
exploitation
if
we
did
that
in
the
right
way
and
we
can
like
control
every
single
piece
of
data
there,
but
an
effect,
it's
mainly
related
to
application
security
itself,
down
to
kubernetes
security
in
particular
because
like
if
you
have
like
like
single
page
app
or
something
that
works
with
your
api,
is
based
on
kubernetes.
So
the
single
this
client
side
issues
will
be
related
to
that
part
of
single
page
app
or
javascript
there
itself
and
other
related
internet
anyhow
at
the
first
stage.
A
So
some
kind
of
insights
I
want
to
share
first
of
all
always
use
privilege,
Linux
parts.
It
means
that
you
cannot
open
port
from
0
to
1023
with
non
root
privileges,
so
it
can
help
who
is
over.
Maybe
in
attack
I'll,
explain
that
a
little
bit
later,
disable
tcp
first
open
inside
bernetta,
syncs,
tcp,
first
open
as
new,
relatively
new
mechanism
invented
at
2.6
kernel
wait
seven
years
ago.
A
So
now
this
is
the
kind
of
like
before
stuff
it
helps
I
take
her
sometimes
to
steal
it
packin
when
from
one
IP
address
to
another
IP
address
and
then
keeps
that
packet
and
use
that
same
token.
That
time,
when
I
take
her
like
compromised,
pod
will
be
like
disabled
or
will
change
innately
address.
So
I'll.
Explain
that
my
number
three
is
run.
A
Everything
from
non
route
will
explain
that
and
describe
how
to
do
that
using
path
security
policies,
another
one
is
don't
use
post
based
application,
so
never
try
to
define
some
kind
of
like
access
controls
using
like
cost
names,
for
example,
IP
addresses,
so
you
can
do
that.
Use
talking
some
stairs
and
I
was
indicate
everything
the
proper
way,
as
we
described
as
been
discussed
before
you
need
to
check
the
code
by
like
static
source
and
dynamic
tools
there
and
implement
something
like
API
protection
solutions
or
IPs
ideas.
A
A
A
An
unprivileged
port
like
4000mah
and
they
did
like
self
kill
of
the
service,
was
reopened
that
from
from
additional
process,
and
since
it
was
like
unprivileged
port,
it
was
happened
and
then
they
just
started
to
listen
everything.
Every
single
like
east-west
communications
there
and
so
secrets
from
dead
services
who
actually
connected
to
that
service
and
then
do
the
same
secrets
to
communicate
with
other
services
and
API
controllers
at
the
a
gateway
using
that
secret,
which
is
actually
common
case.
A
Number
two
here,
as
was
studied,
was
the
same
like
dissertation
bug,
but
in
Ruby
on
Rails
instead
of
Python,
and
then
I
takers
found
that.
So
we
actually
can't
do
something
like
that.
We
can
compromise
it
pushed
based,
publishing,
think
at
API
gateway
and
they
just
registered
their
service
as
another
service
that
they
pay
gateways.
So
they
took
an
access
to
support,
were
able
to
run
the
code
there
and
then
send
a
push
request
to
aka
gateway.
A
A
Unit
two
different
units,
including
life
API
gateway,
and
that
actually
story
can
illustrate
that
very
well,
so
sometimes
like
one
service
can
register
themselves
at
an
API
gateway
as
another
service
like
a
syndication
service,
for
example,
and
start
to
receive
login
and
password.
You
press
that
what
happens
there,
so
it's
pretty
much
everything
I
want
to
cover
today
and
I
want
to
finish
with
that.
A
A
A
They
can
help
at
that
stage
technically
that,
like
application
security
stage,
when
something
bad
will
happen
here,
they
potentially
can
catch
that
before
it
will
be
possible
to
exploit
that.
But
I
believe
that
they
will
blind
the
games
that
can
detect
because
they
are
pretty
logical
attacks
there
but
yeah,
so
they
want
to
protect
you
against
that
level.
A
I
mean
prime
number
seven
here:
application
security,
yeah
and,
as
a
question
I
think
no
I
think
that's
it
everything
we
can
do
for
today,
so
just
maybe
close
it
off
and
again
there
will
be
your
contact
informations
on
the
slide,
so
people
can
definitely
follow
up
if
they
have
more
questions.
Yeah
I
think
there's
no,
like
I've
just
feel
free
to
contact.
You
I
guess
sure.
So.
The
last
part
at
the
last
point,
I
want
to
explain
the
day.
It's
like
how
to
change,
how
to
keep
every
single
made
and
change.
A
A
We
need
to
build
a
process
that,
in
particular
for
kubernetes
mean
that
we
need
to
check
that
yeah
Motown
takes
all
the
time
in
the
right
way
and
to
do
that
we
can
use
some
sort
of
popular
school,
but
they
can
recommend
keyboard
and
actually
funny
thing
that
that
too
was
made
by
the
Shopify
company
that
actually
got
hacked,
as
we
explained
before,
because
of
the
desert
RF
issues
there
and
they
actually
invented
that
tool
technically
protect
themselves
against
things
like
this
in
the
future
plus
to
help
everybody
else.
It's
an
open-source.
A
We
can
download
it
there
and
you
can
do
a
lot
of
things
there.
They
built
and
they've
built
and
some
sort
of
like
out-of-the-box
controls.
We
can't
define
your
own
controls.
You
can
define
enforcement
policies
there.
You
can
apply
additional
stuff
if
you
would
like,
if
you
wouldn't
like
to
do
that,
you
can
just
do
your
own,
yellow,
parser
and
enforce
your
own
policies
here
and
then
apply
that
so.
A
But
once
again
you
need
to
build
this
enforcement
layer
somewhere
out
of
kubernetes
itself,
which
is
kind
of
like
and
they're
all
sync
here,
but
that
it
is
what
it
is
right.
So
it's
more
related
to
framework,
and
if
you
want
to
enforce
something,
you
should
do
it
outside
of
the
framework
and
you
have
a
lot
of
tools.
Oregon
do
y'all,
know
your
own
yellow,
parser
or
write
couple
of
scripts
there,
but
keyboard
is
really
good,
mainly
because
they
did
a
lot
of
like
built-in
checks.
A
So
couple
of
links,
github,
Shopify
keyboard,
plus
kubernetes,
secure
in
the
cluster
guide,
where
you
can
find
like
a
lot
of
other
information,
how
to
do
everything
we
discussed
here
and
the
right
way,
not
everything
like
a
lot
of
things
there.
So
if
you
have
any
additional
questions,
just
let
me
know
so.
You
can
write
me
directly
in
Twitter.
A
That's
this
my
twitter
name
or
ask
question
I'd
like
warm
website,
or
you
can
also
like
a
look
at
our
web
page
to
find
some
contacts
here,
and
we
have
this
like
channel
where
you
can
ask
questions
invited,
chat
way.
If
you
refer
to
you,
that's
it
thanks
even
great
presentation,
alright,
so
because,
if
I
meant
people
already
dropping
out,
thank
you
so
much
for
joining
us
today,
again,
the
webinar,
recording
and
slides
will
be
online
later
today
and
yeah.
We
look
forward
to
seeing
you
at
the
next
webinar
from
CN
CF.