►
From YouTube: SIG Security Update: We Lift Tog... Tabitha Sable, Pushkar Joglekar, Rey Lejano, Savitha Raghunathan
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
SIG Security Update: We Lift Together - Tabitha Sable, Datadog; Pushkar Joglekar, VMware; Rey Lejano, SUSE; Savitha Raghunathan, Red Hat
SIG Security takes a community-building approach to improving Kubernetes security, both for the project itself and our end users. Join organizers Pushkar, Rey, Savitha, and Tabitha for an overview of how we make space for security collaboration to thrive. We'll share timely updates from our tooling and third-party audit subgroups and information about guided security self-assessments for Kubernetes subprojects. In closing, a deep-dive into our efforts to improve security documentation through blogs, tutorials, whitepapers, and goose honking! You'll learn what's been going on, what’s next, and how you could join in, regardless of your experience from beginner to expert. We hope to see you there!
A
Good
morning,
good
morning,
good
morning,
I
am
so
happy
to
see
you
all
here.
Thank
you
so
much
for
coming,
so
that
we
can
share
some
of
what's
been
going
on
with
kubernetes
sig
security,
I'm
tabitha
sable,
I'm
the
other
co-chair
of
kubernetes
security,
and
it's
always
a
delight
to
be
able
to
help
to
make
this
space
for
us
to
be
able
to
improve
the
safety
of
kubernetes
together.
A
So
to
get
into
what
we've
been
doing,
we
should
start
with
really.
What
are
we,
who
are
we,
and
the
answer
to
that
is.
We
are
the
sig
with
the
extremely
broad
scope
of
improving
security
across
the
entire
kubernetes
project,
for
both
end
users
and
the
project
itself
through
building
community
action.
A
There's
there's
no
one
person
that
could
build
kubernetes,
there's
no
one
person
that
can
help
to
make
kubernetes
better,
and
so,
therefore,
we
have
set
ourselves
up
to
be
a
group
that
brings
everyone
together
to
identify
where
there's
places
that
things
can
be
improved,
find
the
folks
who
can
improve
them
find
the
folks
who
are
able
to
improve
them
at
the
time,
and
we
show
up.
We
do
the
work,
we
do
it
together.
We
help
each
other
grow.
A
We
work
on
making
process
improvements
like,
for
example,
we
are
a.
We
are
a
way
that
the
security
response
committee
can
bring
things
to
the
public
when
they
need
feedback
on
their
processes
and
in
general
processes
for
kubernetes
as
a
project
and
also
helping
with
documentation
improvements
because
having
folks
with
a
specialized
security
interest
or
specialized
security
experience
together
means
that
we
can
find
folks
who
are
able
to
contribute
when
there's
documentation,
improvements
that
need
to
be
made.
A
We,
you
know
we
are
here
to
help
to
make
those
happen,
and
you
know,
like
I
had
alluded
to
before
the
way
that
we
do,
that
is
by
building
a
community,
so
that
folks,
who
have
a
security
interest,
can
come
and
they
can
bring
their
gifts,
and
so
that
means
that
sometimes
we
have
very
very
new
people,
people
who
are
new
to
kubernetes
people
who
are
new
to
security.
Sometimes
people
who
are
new
to
both,
but
they
can
come.
They
can
listen,
ask
questions,
and
that
is
a
meaningful
way
to
contribute
to
the
group.
A
A
B
I
am
the
sub
project
owner
or
lead
for
the
third
party
security
audits,
but
you
might
see
me
in
other
parts
of
the
project,
I'm
also
the
sigdoc's
co-chair
and
also
the
123
release
lead
and
the
emergency
advisor
for
125..
So
the
third
party
security
audit
sub
project,
our
goal
is
to
run
regular
third-party
security
audits.
B
Their
overall
goal
is
to
make
the
whole
project
more
secure,
but
the
last
audit
was
ran
in
2019,
where
there
are
34
significant
kubernetes
bones
discovered,
like
credentials
were
exposed
as
environment
variables,
integrate
tls
by
default
no
cent
cop
by
default.
It
has
a
one
119
you
can
have
sucked
out
by
default
as
well.
There's
many
more
you
can
read
about
it
in
the
findings.
You
know
that
are
published
next
slide,
please.
B
And
ncc
group
was
selected
to
conduct
the
2021-2022
audits
the
rfp
was
was
released
in
2021.
We
received
four
proposals
for
the
rfp
and
the
went
through
evaluation
by
security
experts
and
also
kubernetes
experts
as
well.
You
can
read
about
the
decision
process
on
that.
That's
on
the
github,
that's
linked
on
the
slides
available
that
are
available.
B
So
we
are
very
mindful
on
the
changes
like
dual
stack:
pod
security
admission,
controller,
going
to
be
that's
in
beta
in
124
and
psp
is
being
removed
in
125,
but
so
it's
deprecated,
there's
lots
of
architectural
change,
lots
of
things
that
have
gone
ga
since
then,
like
cube,
control,
create
token
etc.
So
we're
very
mindful
of
cognizant
of
those
changes
for
this
audit
next
slide.
Please.
B
So,
of
course
the
primary
scope
is
going
to
be
most
of
the
core
kubernetes
concepts
that
you
see
here:
the
api
server,
the
scheduler,
the
control
manager,
kubelet
q,
proxy.
One
thing:
one
components
that
we
did
include:
that's
in
scope
is
the
secret
store
secret
store,
csi
driver
where
you
can
store
secrets
externally
and
you
can
mount
it
in
a
pod,
can
mount
it
as
a
volume
and
they'll
be
in
your
container
file
system.
We
see
this
more
widely
used.
B
So
that's
why
we
decided
to
be
in
the
in
the
primary
scope
of
the
security
audit
and
secondary
scope
is,
of
course,
ncd
because
it's
a
it
is
another
part,
another
separate
project
as
well
in
the
cloud
controller
manager.
Just
because
not
every
kubernetes
user
will
use
the
cloud
controller
manager
as
well.
B
Next
scope,
next
slide.
Okay,
so
what's
next
for
the
for
the
sub
project,
we're
going
to
publish
the
findings.
Also,
the
this
project
kubernetes
project
is
so
large.
There
are
47
of
46
enhancements
in
124
47
in
123,
over
50
in
the
last
in
the
previous
two
and
at
115,
there's
only
25.
So
we
see
this
velocity
increase
and
almost
double
with
each
release
so
and
also
we
released
from
four
releases
a
year
now
three
releases
a
year
so
from
2019
to
2022.
B
That's
a
lot
of
releases,
so
what
we've
done
is
that
we
created
an
audit
roadmap.
There
are
many
components
of
kubernetes
they're,
not
in
scope.
So
what
we
want
to
do
is
include
these
and
run
a
smaller
scale,
security
audits
on
these
third-party
security
audits.
In
these,
so
we
want
to
establish
a
roadmap,
so
things
like
cluster
api
will
be
included
or
windows.
Worker
nodes
will
also
be
included
as
well
in
the
near
future.
A
C
C
C
The
grasslands
is
six
security,
trying
to
find
alignment
and
everyone
coming
together
to
make
their
dreams
about.
Kubernetes
security
come
true,
so
sometimes,
although
it
can
be
a
bit
confusing,
it
can
be
a
bit
overwhelming
as
well
to
understand
how
do
I
even
go
about
fixing
things
that
are
important
for
me
in
security?
C
C
So
now
the
goal
of
us
is
to
reduce
the
sticker
price,
but
this
kubernetes
security
itself
cannot
be
fixed
by
me
or
everyone
else
on
the
stage,
but
it
needs
everybody's
help.
So
what
do
you
have
to
do
if
you
have
to
consume
and
make
it
easy
and
reduce
the
sticker
price
or
want
to
make
sure
that
it's
worthwhile?
You
peel
the
orange,
so
let's
peel
it
together
and
when
I
started
peeling
the
orange
just
like
I
was
trying
to
get
myself
familiar
with
the
community.
C
C
This
is
one
other
sick
architecture
and
then
there
are
other
six
like
sick
contributes.
Then
we
have
sick,
kids
in
front
all
of
them
look
similar,
but
until
and
unless
they
all
come
together,
we
can't
really
secure
it
and
we
can't
really
feel
like
we're
there.
So
that's
what
I
had
to
do
figuring
out
how
to
peel
the
orange,
which
is
a
community
in
this
case,
and
how
to
figure
out
a
pathway
where
everyone
can
come
together
and
make
their
dreams
of
kubernetes
security
come
true.
C
So
hopefully
this
helps
we
and
one
of
the
things
I
also
realized,
is
not.
Everyone
is
at
the
same
expertise
level
as
everybody
else.
So
what
we
did
as
part
of
that
was
create
a
space
for
new
contributors
to
share
and
learn,
and
what
I
realized
is
not
only
new
and
existing
contributors
who
are
interested,
but
they
were
excited
to
share
about
things.
They
have
learned
things.
They
have
been
working
on
and
get
feedback
from
the
community.
C
C
C
So
that's
where
I
came
in
and
the
story
is
raccoon,
who
is
the
logo
of
our
tax
security
at
cncf
and
turtles
on
stacked
on
top
of
turtles?
Is
the
logo
of
cluster
api
were
really
two
groups
inside
the
community
who
are
trying
to
come
together
and
I
said
I'll
host
a
space
for
you,
and
this
is
how
security
self-assessments
was
born.
So
let's
talk
a
bit
about
that.
C
C
D
D
Now,
if
you
go
look
at
it,
it's
all
over
the
place
and
the
documentation
and
security
in
some
places
are
very
thin.
So
that's
where
that's
what
we
are
working
on
and,
as
you
know
it,
and
if
you
have
heard
all
my
other
coach
co
leads
in
the
chairs.
Talk
talk
about
our
security.
You
know
like
we
love,
collaborating
and
contributing
together
and
that's
what
we
do
in
this
project
as
well,
so
we
want
to
like
call
all
the
beginners
who
want
to
learn
about
security.
D
All
you
have
to
like
bring
to
this
group
is
that
mindset
have
the
security
mentality
that
everything
needs
to
be
like
secure
by
default.
It's
not
an
afterthought
and
that's
what
we
want
and
just
a
passion
to
learn
and
share
knowledge.
We
love
sharing,
and
you
saw
pushkar
showing
the
like
the
two
links
of
project,
how
they
are
doing
the
demo,
videos
and
the
stuff.
So
we
love
sharing.
D
So
that's
what
we
do
here
and
while
we
do
that,
we
also
try
and
improve
the
existing
examples
and
the
documentation
add
new
ones,
and
also
we
want
to
create
a
security
awareness
to
everyone
like
again
when
you
are
developing
a
product
submitting
a
project
design
or
anything.
You
should
always
have
security
in
your
mind
and
your
design
and
your
product
should
include
that
it's
not
an
afterthought.
So
that's
what
we
want
to
create
like
when
you
look
at
kubernetes.
You
need
to
know
like
it
comes
with
security.
D
So
we
are
trying
to
create
that
awareness
through
this
project
now
that
we
have
discussed
a
bit
about
like
the
project
goals
and
we
will
actually
in
the
session
go
much
more
deep
dive
into
what
we
have
been
doing
since
the
six
security.
The
group
was
started
with
respect
to
the
documentation
area,
so
the
we
have
a
couple
of
current
projects
and
one
of
them
is
yeah.
Thank
you.
One
of
them
is
the
security
checklist
that
amazing
folks
have
been
working
on
and
at
first
we're.
D
Gonna
focus
on
the
administrator
perspective,
the
operator
perspective,
and
we
want
to
expand
it
to
the
application
developer
perspective,
then,
after
that
the
next
version
would
be
for
the
application
developer
perspective.
Why
do
we
want
to
do
this?
That
the
operator
and
the
developer
can
print
this
sheet
or
like
have
it
side
by
side
and
like
check,
check,
check,
check
and
then
go
to
bed
with
peace?
You
know
like
okay,
my
cluster
is
secure
by
default
to
an
extent,
I'm
not
saying
that
this
is
the
bulletproof
list.
D
You
have
to
be
also
like
very
aware
and
like
do
the
due
diligence,
but
this
gives
you
like
a
basic
list
of
the
things
that's
needed
and
the
next
up
is
going
to
be
the
psp
deprecation
and
ray
talked
about
it
that
it's
going
to
be
deprecated
in
1.25,
and
what
are
we
going
to
do?
We
are
going
to
work
with
sig
auth
and
seek
documentation
and
support
them
figure
out
how
we
can
help
like
updating
the
examples,
making
a
transition
plan
right,
adding
more
blog
posts
and
so
on.
D
So
that's
the
next
project
that's
going
to
come
up.
This
is
like
the
main
two
for
like
next
for
the
next
quarter
or
like
four
or
five
months.
Next
slide,
please
yeah!
So
let's
take
a
deep
dive
into
like
what
we
have
been
doing.
So
I
have
divided
this
into
like
three
categories.
One
is
the
blogs.
The
next
up
is
the
tutorials
and
tasks,
and
the
next
up
is
the
papers
and
threat
models.
D
D
They
included
the
co-authors
of
this
blog
in
their
version,
one
one
to
get
our
feedback,
and
this
is
what
we
talk
about
collaboration
right
folks
like
it's
just
not
about
within
the
sig
and
like
among
community's
sake
or
like
within
kubernetes
and
cncf
tax
security.
It's
about
like
everywhere,
like
we
love
to
collaborate
with
everyone
and
like
we
want
to
make
security
community
security
a
better
in
it,
leave
kubernetes
security
in
a
better
state
like
just
like
pushkar
described.
D
I
can't
get
that
orange
analogy
out
of
my
mind.
I
love
oranges,
and
so
that
is
the
first
blog
and
the
second
blog
is
about
how
we
collaborate
between
the
tag,
security,
which
is
the
cncf
group
for
security.
It's
like
version
of
security,
how
we
collaborate
between
those
two
groups
and
it
highlights
the
white
paper
that
was
published,
and
recently
there
was
the
version
two
of
the
white
paper
that
was
published
and
that
was
led
by
pushkar.
D
So
like
it
was
very
awesome
to
see
people
come
together
from
like
different
backgrounds
and
like
different
mindsets,
I'm
going
to
move
on
the
next
one.
That
is
the
that
is
about
the
securing
controllers.
Right,
you
might
have
used
authentication
authorization
and
administration.
Web
hook
is
like
another
way
to
secure,
add
security
to
your
cluster.
D
But
if
you
what
happens,
if
you
don't
secure
the
deployment
itself
right
like
if
you
just
give
wrong
permissions
or
like
if
it's
not,
if
there
is
a
security
loophole
that
you
can
go
get
in
the
entire
cluster,
and
then
you
can
do
like
anything
that
the
hacker,
not
the
right,
the
bad
guys
can
get
in
the
cluster
and
can
do
anything
that
they
want.
So
this
post
describes
about
the
ways
of
best
practices
to
deploy
a
admission
controller,
and
it
also
talks
about
other
things.
D
If
you
haven't
the
final,
one
is
my
favorite
right
whenever
I
think
of
hardback,
I'm
thinking
of
this
quote-
and
I
mentioned
this
in
the
last
time-
whenever
I
mentioned
it
again,
and
it's
like
we
are
all
made
up
of
stores,
but
your
our
bag
shouldn't
be
right,
like
you,
shouldn't
have
like
wide
open
permission
and
you
don't
know
like
if
you
haven't
met
ian
coldwater,
they
are
sitting
right
here.
You
can
wave
at
them.
D
They're
awesome
so
like
this
guide
takes
you
through
the
best
practices
again
like
what
you
can
do
to
secure
a
secure
your
our
back
manif,
our
back,
are
back
in
your
cluster.
Okay
makes
slightly
so
we'll
move
on
to
the
tutorials
and
stop
task.
So
we
talked
about
the
part
psp
replication
right.
So
the
thing
that
is
re
replacing
the
psp
is
the
power
security
standards,
and
these
are
the
two
examples.
The
first
two
are
the
tutorials.
D
That's
gonna
walk
you
through
how
to
apply
them
at
the
cluster
level
and
the
namespace
level.
All
you
need
is
kind
and
cubectl.
I
know
one
of
the
fellow
contributor
is
also
working
on
improving
it
by
using
container
d,
and
that's
gonna
come
out
soon
keep
an
eye
out
for
that.
If
you
don't
have
docker
in
your
local
system
or
at
your
work
machine
that
some
places
that
you
cannot
like
with
all
the
changes
recent
changes.
D
So
if
you
have
container
d
so
someone
is
also
working
on
or
gonna
work
on
that.
So
when
we
have
it,
we
will
publish
that
as
well
and
the
last
one
is
my
favorite
like
we
love
collaborating
so
basic
security
and
the
sig
release
collaborated
on
the
supply
chain,
security
right.
That
is
the
bus
word
for
now,
like
everywhere,
it's
there
and
I
think,
with
1.24
1.25,
the
kubernetes
release
team
is
aiming
to
make
community
salsa
level
three
with
wonder
24.
D
They
did
release
the
container
the
control,
pane
container
images
that
can
be
that
are
signed
and
you
can
verify
it.
There
is
this
little
task
in
here.
You
can
go
and
run
like
a
few
commands
to
see
the
verified
signatures
so
that
that
is
pretty
cool
neat.
I
think
as
the
next
one
please
thank
you.
So,
let's
talk
about
the
papers
and
thread
models,
not
only
like
we,
we
just
focus,
we
don't
just
focus
on
the
website.
D
We
also
like
try
to
add
a
documentation
about
like
threat
models
and
like
white
papers
and
whatnot.
The
first
one
is
again
about
the
admission
control
it
talks
about
like
the
attack
surface.
If
you
deploy
the
admission
control
and
not
the
secure
way,
it
takes
you
through
the
threats-
and
it
also
has
mitigations
listed
in
that-
and
the
next
up
is
the
policy
management
and
that
one
talks
about.
Why
do
we
need
policy
and
how
you
can
implement
policy
in
your
communities
cluster?
D
I
think
that's
all
the
work
that
we
have
done
so
far
and
we
have
like
many
more
to
come
on
the
next
slide,
please.
So,
if
you're
interested
right,
this
is
where
we
need
all
your
help.
If
you're
interested,
if
you
have
an
idea,
if
you
want
to
like
stop
by
and
contribute
you
don't
need
to
have
any
experience,
all
you
need
to
have
is
come
with
the
mentality
that
you
want
to
learn,
share
and
grow,
and
you
have
you
think
about
security.
D
All
the
time
right,
so
please
stop
by
the
slack
channel
we
meet
once
a
month
and
we
are
not
so
particular
about
the
meeting.
If
you
cannot
make
it,
we
do
a
lot
of
asynchronous
collaboration,
I'm
all
in
for
that,
because
sometimes
there
was
a
time
that
I
didn't
even
know.
That
meeting
was
happening
and
it
dropped
off
my
calendar
and
I
couldn't
make
it
so
like
folks,
are
so
nice
that
we
caught
up
on
asynchronous
slack
thread
so
things
happen,
and
you
cannot
make
it.
D
A
A
Because
of
the
way
that
we
work
on
this
basis
of
people
showing
up
consensually
and
working
together
in
the
places
where
they
can
really
wanted
to
give
credit
to
all
of
the
folks
who
are
involved
like
we,
we
do
a
lot
to
make
that
space
and
to
make
it
so
that
there
are
these
opportunities
for
us
to
be
able
to
work
together.
But
that's
you
know,
that's
only
the
beginning
of
it.
A
A
You
know
can't
really
get
everybody
on
the
slide
like
we're
now
at
almost
a
thousand
people
in
the
slack
channel-
and
you
know
every
couple
of
weeks
we
get
together
to
to
address
the
things
that
are
the
things
that
are
on
our
mind,
the
things
that
are
in
progress-
and
you
know
usually
that's
over
a
dozen
folks
who
are
who
are
sharing
things
and
and
working
things
out
together.
So
you
can,
you
can
come
and
join
us
you
can.
You
can
be
part
of
that.
A
A
E
D
That
is
because
I'm
just
selfish
and
I'm
like
leading
that,
but
I'm
I'm
also
gonna,
say
like
we
could
use
the
help
and
across
the
sig
right
like
there
could
be
new
new
things
that
we
don't
know
or
we
are
overseeing
like.
We
know
it,
but
we
might
not
know
that
that's
what
the
contributors
and
the
people
who
are
consuming
might
need
it.
D
A
Folks
can
help
in
part
by
by
coming
and
being
part
of
that
process,
because
sometimes
there
are
ideas
that
are
there
and
are
good
ideas,
but
at
the
time
there
aren't,
you
know
there
aren't
folks
who
can
work
on
it,
and
so,
if
somebody,
if
somebody
comes
and
wants
to
contribute
you
can,
you
can
come
and
ask
and
say:
hey,
what's
what's
going
on,
these
are
my
interests
and
there's
there's
ideas.
There
are
some
issues
there
and
also
there
are.
A
Can
we
do
this?
We
discussed
it
together
and
you
know
we.
We
realized
that
this
was
a
service
that
we
could
offer,
and
so
this
first
one
is
done
by
the
folks
who
were
there
like,
as
as
a
project
that
the
sig
in
general
was
was
taken
care
of
and
as
that
went
through,
there
was
the
realization
that
that
could
be
made
into
a
process,
and
there
was
an
opportunity
there
to
mentor
someone
into
a
subproject
owner
role
and
that's
happening
now
and
so
like.
That's
that's
how
we
live
and
grieve.
E
We
are
at
time
also
because
I
literally
cannot
help
myself
and
I'm
the
co-chair
if
you
are
involved
in
other
cigs.
We
also
encourage
collaboration
from
other
cigs
with
us,
so
like
come
and
talk
to
us
at
sig
security.
If
you
have
thoughts
on
security,
stuff,
we'd
love
to
work
with
you,
this
we
are
at
time.
Thank
you
all
so
much
for
coming.
I
really
appreciate
you
being
here.
Thank
you
all
so
much
for
presenting.