►
From YouTube: Hardening Multi-Cloud Kubernetes Clusters as a Service – Dirk Marwinski, SAP SE & Alban Crequy
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Hardening Multi-Cloud Kubernetes Clusters as a Service – Dirk Marwinski, SAP SE & Alban Crequy, Kinvolk GmBH
SAP operates Kubernetes clusters at scale. We collaborate with partners to add new features and workloads across multiple cloud providers and on premise. This activity presents us with the unique challenge to secure clusters for multiple tenants, while taking cloud provider’s security best practices into consideration. In this talk, we share our security journey that we undertook together with Kinvolk and present surprising findings such as information leakages and breaches. We will also show and discuss our hardening activities and countermeasures which we have implemented for operating Kubernetes at SAP. This talk will be interesting to all conference participants operating Kubernetes. It will help them to think in different directions to identify possibly unknown attack vectors specific to their environment and how to mitigate them.
To learn more click here: https://sched.co/H2Hd
A
A
A
A
A
A
A
Okay,
so
that
is,
of
course,
a
cluster
setup.
Anything
from
the
start
not
really
bad
thing
graffiti
hettenshausen
that
you
wanna,
fully
managed
wanna,
make
sure
the
orders
running
on
content.
How
update
ends
up
very
motivated?
We
have
time
to
the
hans
moll
cluster.
We
have
mirko
be
using
a
lot
of
processing
power,
masternaut,
rubino,
heidelpay
resources
and
use
are
quite
started,
then,
as
cabriolet
or
jute
performance
in
the
job
exchange
gave
100
percent
automation
as
well
as
do
anything
the
intervention
of
a
grid
triad.
Take.
That
means
that
rivals
did
optimizing.
A
The
master
optimizing,
lighter
parameters
from
the
server
of
world.
Updating
the
clusters
update
cases
is
the
configuration
of
the
concept
c
class
won
was
after
alcohol.
Lask
am
see
under
class
j,
as
you
then
refuse
couple
of
workers,
network,
world
sailing
cup
of
load,
balancer,
a
gift,
basic
the
danger
stakeholders
to
control
the
workers.
A
Yes,
we
can
say
the
parents
now
in
new
class,
toilets
wassercluster
avenue
namespace
in
the
seed
cluster
honored
control,
plane
class
advantage
is
but
stakeholders
no
control
a
s
class.
So
the
ksc,
the
server
at
bern
not
able
to
change
configuration,
sunny
weather
version
to
heart,
possibility
to
adopt,
saw
configuration,
but
only
variant
of
green
week
and
restoring
updates.
So
here
we
like
hiking
day
factor
that
is
shared
infrastructure
in
c
class
of
mini
control,
cranes
at
school,
linter,
4
bit
of
water.
A
A
A
The
basic
lidl
garden
to
garden
as
leader
of
the
hartz
system,
such
top
garden,
close
to
create
clusters
to
modify
clusters,
gartner,
probably
manager,
and
will
monitor
the
clusters.
A
will
repair
clusters
was
so
herzel
stakeholders,
location,
okay,
let's
make
money
last
the
workers
are
the
world.
We
toss,
gartners,
the
zerotracer
graz
bronze.
We
have
you
tube
station
feature
table
to
say:
okay,
music]
act
average,
but
the
costs
trickl.
A
Okay,
so
canada
school
classes,
you
get.
Is
you
apartment
the
solid
ki?
Do
whatever
you
want?
Your
partner
is
complicated
because
partys
perfectly
okay,
that
looks
cluster.
The
basic
like
the
apartment,
building,
the
partner
exchange
master
key
to
freezing
yes,
so
great
apartments
and
bulgari
service
is
not
of
department,
company
and
master
keys
to
use
what
the
challenges
here
want.
A
far
guests,
japan
with
yuki
that
may
stay
in
you
say
say,
say,
say
you
don't
want
you
gotta
landlord
be
for
fall,
shared
infrastructure
cities,
systems
that
unit
keyboards
code.
A
He
still
fast
from
multi
tenancy
cluster,
so
can
also
don
t
care
band
from
nashville.
Roby
gasser
from
danger
is
ross
of
the
danger
series
by
no
means
in
your
partner
sales,
amsdorf,
autosave
examples,
apartment
and
sword
of
the
guests.
Panel
trading
partners
bring
the
penalties.
It
cluster
1
basic
league,
wissing
that
in
the
agency.
A
A
A
The
second
look
at
the
start
of
the
projects:
stakeholders
not
to
do
things
because
we're
not
sure
what
I
somehow
probably
haven't
built
yet
tube
an
facts
to
back
extra
article
ventures,
limited
and
no
idrissou,
zero
trust
as
well
as
khan
trust,
the
people
da
dran.
The
work
of
second
opinion
from
the
album
disco
league,
michael.
A
B
Cup
christoph
control
plans,
sun
java
cloud
provider
provides
that
the
cloud
provider
recognized
before
under
protection,
the
ver
and
christoph
pepper
media
studios
recognized
that
again
yesterday
and
you
here
again:
training
the
trampoline
and
the
user
life
form
the
record
and
ingo
butters.
The
klopp.
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
A
A
A
We
were
code
in
the
national
league
of
a
couple
of
three
and
commercial
tools,
special
as
possible
in
commercial
tools
before
the
behavioral
analysis,
because
the
studio
develops
the
soffin
people
in
the
fiat
holds
the
is
everything
that
might
be
extremely
david:
slade.
Okay,
you
in
ordos
port
security
policy
and
second,
but
application
that.
A
Brings
us
the
know
how
to
ride
business
application
support
light
building
cars
space.
That
is
a
cut
clyde
hard
to
do
so.
The
idea
is
what
is
it
like?
The
loco
download
application
developers
knows
the
playstation
ivan
basso
ran,
some
of
which
is
today
and
the
ford
kuga
nice
things
for
the
prussians
from
the
job
must
maybe
someday
is
blood
means
how
the
problem
in
case
of
which
they
can
run
the
quest
for
use
case.
We
have
a
lot
of
use
cases,
radar
of
the
current
location
down.
A
Comment
on
its
could
have
utility
friends
will
houston
in
the
fall?
Have
small
features
as
guests
have
a
ds
oscar
fans,
so
wansing
is
and
need
to
block
the
access
to
data
services,
ready
dangerous
des
containers,
privilege
containers,
privilege
escalation,
the
neuhofer.
It
is
officially
together
ostric
segment
from
amoco.
If
the
sales
services
from
porz
can
already
be
on
tour.
A
So
is
the
south
thuringian
cuba
of
the
cluster
logistic
hearing
of
the
setup
cuba,
nice,
especially
and
cuba,
not
that
it
has
a
bit
far
so
lowers
dual
power.
Button
will
keep
walking
shortly.
Work
was
the
anime
battenberg
looking
to
make
sure,
because
the
infrastructure
cities
were
according
to
business,
server,
talking
trading
house
on
no
2000
on
clusters,
data
services,
the
criticism
here
and
you
shared
account
so
albums
presenter
to
nobody
drives
equator
cloud
providers.
A
The
tryin
contains
then
support
to
have
the
application
security
man,
the
brite
limit,
blast
radius,
relieve
pentax
europe
is
you
by
now
the
lord
mohr
kuwait
is
knowledge,
but
when
you
have
set
up
with
the
stars
in
front
of
the
political
space,
104
closing,
thank
you
and
slides
the
a
couple
of
life
sciences.
The
is
the
gartner
report
page.
It
is
going
to
have
ciencias
blog
video
in
youtube.
18
presentation
explains
the
bodytel
boarding
cards
is
and
hartberg
his
album
is
called
provided.
C
C
C
C
A
C
D
D
D
D
D
D
D
B
A
Is
also
so
loud
were
syncsort
accounts.
The
charts
on
the
fast
track
scheiding
so
should
be
a
bit
far
a
fool
to
putlitz
and
discount
a
bed
in
almost
already
component
of
count
basic
the
pending
cloud
provider
and
composed
implementation
of
alcan
specialty
sheet
switzerland.
There
are
big
problems
because
there
is
no
access
to
you
to
end
users,
so
the
pending
yuan,
the
infas.
A
A
D
A
The
salad
baroux
can
do
to
lock
down
also
with
the
glass
carrier
with
the
blowpipe
criticism
of
the
fdp
wants,
with
inge
blask
tradings,
with
ok,
gtx
rabanne
conclusion.
A
second
attractive
builds
the
lever
tools
that
activia
running
in
the
clusters,
looking
for
once
a
after
b
401
upper
hand
and
psn
security
ds
to
lockdown
everything
to
monitor
that
progressed
to
a
club,
behavior
and
add
on
that.
So
if
he
now
probably
always
asks
commercial
tools
adamos
that
istanbul,
then
the
badge.