Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2017 (Berlin), 6 Apr 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Keynote: Red Hat is Driving Kubernetes/Container Security Forward - Clayton Coleman

Description

Keynote: Red Hat is Driving Kubernetes/Container Security Forward - Clayton Coleman, Architect & Engineer, Cloud Orchestration and Containers, Red Hat

- Know your registry
- Don't trust containers to run as root
- Creating isolation using projects
- Encrypting inter-node communications
- Running on a secure Linux host

About Clayton Coleman

Architect, Kubernetes and OpenShift
Clayton is architect and engineer on cloud orchestration and
containers at Red Hat, in charge of both technical direction for
Kubernetes and OpenShift (Red Hat's platform as a service built on top of Kubernetes) as well as the broader container and container content efforts at Red Hat. Clayton is one of the top contributors to both Kubernetes and OpenShift and has been involved in many projects in the container, platform-as-a-service, and ci/cd ecosystem over the last four years. He enjoys sleeping, but rarely has time to do it anymore.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

So I'm incredibly excited to come here and talk to you about the most boring and depressing topic in all of computing. Security is really important to kubernetes.

A

So, first off by a show of hands, how many people here run their own kubernetes or kubernetes variant cluster for themselves or for the views that they have awesome and how many people use a kubernetes cluster or kubernetes variant that somebody else provided for you or run it for a lot of people?

A

Okay, a few hands so that first group. This is what I think you guys.

A

And it's okay right! This! That's the point of kubernetes it's a tool. It helps us get our jobs done and lots of run applications more easily. We can deliver software faster and all of the benefits of DevOps and all that really come down to. It doesn't work for you that second group. That second group is maybe the the alternate side of the world, which is if we talk about kubernetes as a platform, and we've been talking about kubernetes as a platform for a very long time since the beginning of the project.

A

That means that, ultimately, people are going to do really boring things on kubernetes and it's okay to be boring. Right, like you know, you come in, you do your job, you go home. You want your workloads to run from 9:00 to 11:00. You don't want someone to play the radio too loud.

A

You don't want someone to steal your stapler, and this kind of coming together on a platform red-hats been involved from the very beginning, I'm through openshift, which is a platform for running multi-tenant kubernetes, and so we you know in the community and in open ship. We thought a lot about these two topics, so there we're on a journey with security, it's not a destination, it's a series of steps, as we've kind of gone from the do-it-yourself mindset as we're moving towards platform, there's a number of tools that are going to help us get there.

A

Some of them we have today our back is really fundamental separating out people into what they can do. A number of these others are also very important, they're things that are available today in Kerber Nettie's. You may not have heard about him, because sometimes we don't do a great job of telling you that you can use these things or telling you how to use these um there's still a lot of tools that we want to add. So again, this is kind of a forward-looking talk.

A

We want to add things that make it easier to secure kubernetes to secure the applications that run on kubernetes to build a secure ecosystem of tools, and that's going to take time.

A

You know these are kind of very low-level feature e type of details that you may have heard about in an email thread or a blog post or you've seen someone mention and we'll get there right like it's a journey, we're gonna start we've started in you know three years ago, in the open source community and today and 1-6, you know we have our back on by default.

A

Well, mostly on by default, is on for Cuba Cuba atom and, as we add, more tools and more deployment mechanisms, a lot of these questions come up, which is: are we doing the things that we need to secure kubernetes out of the box?

A

Do we know all of the questions that we should be asking ourselves as we're deploying kubernetes? What are the tools responsibilities if you're, if you're doing it all yourself? Maybe these questions are irrelevant to you, because you've got everything locked down so tight that only you can see it. You're running a single system doesn't matter on that right end of the spectrum, if you're running this for ten thousand people or hosting it in a cloud for others to consume.

A

A lot of these questions are gonna, be lifeblood for you and we need to make sure that as a community, we have the necessary steps in place to make it easy to happen. So the first question- and this is a really hard question- I- think we're still struggling with us even in the one six release. This actually came up, you know less than a week ago was: are we ready to force everyone in the community both sides of that spectrum to be secure by default, and we kind of wavered a little bit? We said.

A

Well, you know if we turn on security for cluster up, which is still, you know, a very common way to deploy kubernetes, we could break people's applications and if there's one thing, that's maybe not more important, but almost more important than security, its stability, it's that you can trust the applications to keep running on kubernetes and that we as a community, give you that continuity.

A

That's the most important thing was security, just a smidge down below, so we didn't turn on our back by default and cluster up, but it's on in cube admin and over time. We need to have that conversation in the community about how we, as a group we as a set of users, admins developers, vendors loudmouths people who come in and want to, you know, impose their opinions on others. How we try to move this forward together. We want to help, make the ecosystem secure by default, and that's going to take work right.

A

Just because kubernetes has our back doesn't mean that the things that run on kubernetes are using our back correctly. We need to go. Do some of those features there and that's actually on sig offs list and I. It says red hut and sig off red hat is not sig off red head is a part of sig off just happens that some of the most paranoid and opinionated people I know happened to work at Red Hat and happened to work on kubernetes.

A

So as a as a group as a community, the question I would have for you is: how can you help us get to the point? We need to be with security. You need to tell us to be able to feedback, to help us set the direction and to be involved, because this is not something that Red Hat as a company is going to go Drive. This is something that we're going to participate and help everyone in this room get the security they want without compromise. That's it. Thank you very much.