Constellation - The first always encrypted Kubernetes by Moritz Eckert

SF Bay Cloud Native Open Infra Meetup

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Confidential computing is a relatively new technology that allows one to keep workloads encrypted and isolated in memory during processing. If used correctly, confidential computing can shield workloads from the underlying cloud. It's the first technology that effectively prevents data access from the cloud provider and its employees, co-tenants, and hackers coming through the infrastructure. Constellation (https://github.com/edgelesssys/constellation) is an open-source K8s distro/engine that applies the confidential-computing concept to entire K8s clusters. Constellation ensures that all data in the cluster is always encrypted - at rest, in transit, and at runtime. Constellation also provides hardware-rooted "whole cluster" attestation with which the integrity of a cluster can be verified remotely. (This process partly relies on the amazing Sigstore project.) Operations-wise, Constellation is very much vanilla K8s and should work with existing tooling. It's easy to set up and the security features are largely transparent to the DevOps engineer. To run, Constellation requires the availability of "Confidential VMs", which are available in Azure, GCP and elsewhere. In this talk, I'll give an introduction to confidential computing, discuss the motivation behind Constellation, discuss the exciting use cases, give an overview over its architecture, and show a demo.

Technology

Constellation - The first always
encrypted Kubernetes

2
Your app
Cloud
admin
Datacenter
employee
Cloud
How to protect against Infrastructure
based threats?
Other tenant
Foreign
government
Hacker

4
Your app
Cloud
admin
Datacenter
employee
Cloud
How to protect against Infrastructure
based threats?
Other tenant
Foreign
government
Hacker

5
Your app
Cloud
admin
Datacenter
employee
Cloud
Confidential computing protects with
runtime encryption & remote attestation
Other tenant
Foreign
government
Hacker

6
Confidential VMs
Intel TDX, ARM CCA
Defining properties
AMD SEV
🏝 Isolation
🏃‍♀️ Runtime memory-encryption
📃 Remote attestation
🔒 Sealing of state
…
Hypervisor
Hardware
App
Guest OS
Host OS

7
Where is Confidential Computing available?

8
Who is using it?
Banking, financial
services & insurance
Telecom, Edge & IoT
Gov. & public sector
Healthcare & life
science
Manufacturing
Retail

9
Level 1
Protect keys
Level 2
Protect single containers/apps
Level 3
Protect entire deployments
The different flavors of confidential computing

10
Node B
Node A
Storage
Confidential
context #1
Confidential
context #2
Cloud
DevOps
engineer
From a Confidential VM…

11
Node B
Node A
Storage
DevOps
engineer
Cloud
Confidential
context
Attestation
… to a Confidential Cluster

12
Node B
Node A
Storage
Cloud
DevOps
engineer
Constellation Nodes
Confidential VM

13
Unified Kernel Image
Bootloader
Constellation Nodes
…
Firmware
Bootstrapper
k8s
State Disk rootFS
Pod …

14
On prem
Manually managed
Fully managed
Automatically managed by CSP
Join
Update OS
Scale
Update K8s
Cluster management strategies
Join
Update OS
Scale
Update K8s
Admin in control CSP in control

15
In cluster
Autonomously managed
Join
Update OS
Scale
Update K8s
… meeting in the middle
Admin & cluster in control
Confidential
context

16
Constellation Services
JoinService KeyService
Node
Operator
…

17
Autonomous Join
New node
New node
Join Service
Join Service
aTLS handshake
Request to Join
JoinToken, …

18
Node B
Node A
Storage
Cloud
DevOps
engineer
Current status…
Attestation

20
Encryption in transit
• Wireguard VPN between Nodes
• Strict-mode preventing any
leaked packages due to only
eventually consistent state
• Blog post coming soon on
blog.cilium.io

21
Encryption at rest: Kubernetes cluster state
✓ Storing etcd on encrypted and integrity protected disks
▪ Recovery:
✓ Automatically if at least one etcd node is healthy
▪ Manually via CLI in case of a disaster

22
Encryption at rest: Volumes
Problem: Backend-encryption not enough – need in-cluster encryption
▪ CSI plugins for encrypted block storage (Azure Disk , Google PD)
▪ Encrypted RWX File and Blob storage based on Rook/Ceph

23
Node B
Node A
Storage
DevOps
engineer
Cloud
Attestation
… bringing it all together

24
constellation config generate <cloud>
constellation create
constellation init
kubectl [scale anything!]
Demo

26
Container
Container +
Cloud
storage
DevOps
engineer
The first always encrypted Kubernetes

27
Protection against infrastructure based threats
Status quo
Datacenter
employee
BIOS &
Firmware
Host OS Hypervisor Cloud admin Guest OS Application
Software and insiders with potential access to data.
You don’t have to trust the cloud provider and cloud admins anymore.
BIOS &
Firmware
Host OS Hypervisor Cloud admin Guest OS Application
Datacenter
employee
Workload
Infrastructure / cloud provider
Workload
Infrastructure / cloud provider

29
Thanks!
▪ Check it out on GitHub:
https://github.com/edgelesssys/constellation
▪ Get in touch via @m1ghtymo
▪ Or join us @ https://discord.gg/rH8QTH56JN
Learn more
CLI demo
Features,
benchmarks, etc.
App demos:

The most important engineering pillar in the cloud security ecosystem is how you build a trusted platform. It is more than just 2FA and encrypting all data. We will walk through some next generation thinking in Google’s vNext cloud security pillar and how you should look at the cloud security stack layers to ensure you truly have a trusted platform for next generation applications and data. (Source : RSA Conference USA 2017)

Confidential Computing overview

Mark Argent

Autopilot : Securing Cloud Native Storage

As enterprises adopt cloud native infrastructure to run their applications, data security and compliance is becoming a crucial area of interest. When you run your containers in a public cloud, you want to make sure that the data being accessed is secure and that there are no bread crumbs left behind once the container exits. A common mistake many people make is to host-mount a volume directly inside a container, which leaves the container's data behind (directly on the host.) In this session, we focus on the best practices for ensuring the security and compliance of your applications’ persistent volumes. But ensuring security is an on-going exercise. Ideally you would deploy intelligent software that can constantly monitor and audit the application environment for security holes and breaches. Autopilot is an automated application runtime management engine built for Kubernetes, and is an open source project sponsored by Portworx: https://github.com/libopenstorage/autopilot Presented by Gunjan Patel, Gou Rao, and Aditya Dani, January 2019. More details here: https://www.meetup.com/openstack/events/258284618/

Kubernetes in Docker

Docker, Inc.

Containers and Nutanix - Acropolis Container Services

NEXTtour

.NET Fest 2019. Alex Thissen. Architecting .NET solutions in a Docker ecosystem

NETFest

You must have noticed how Docker and containers is playing a more and more important part in .NET development. Docker support is everywhere, so it should be easy to build solutions based on container technology, right? But, it takes a bit more to architect and create a .NET solution that use Docker at its core. Many questions arise: How do you design a solution architecture that fits well with containers? Would I use .NET or .NET Core? What is a proper way to migrate to such an architecture? What changes in the .NET implementation from pre-Docker solutions with micro-services? Where do container orchestrators fit in and how do I build and deploy my solutions on a Docker container cluster, such as Azure Kubernetes Service? These and many other questions will be answered in this session. You will learn how to design and architect your .NET solutions and get a flying start to create, build and run Docker-based containerized applications.

Gordon's secret session kubernetes on windows

Docker, Inc.

Kubernetes fingerprinting with Prometheus.pdf

KawimbaLofgrens

How Attackers Use Exposed Prometheus Server to Exploit Kubernetes Clusters. The first step in any pentesting, ethical hacking or cybercriminal groups, is to gather as much information as you can about the target you want to breach. Why? Simple, to know what technique to use or the appropriate tools to achieve intrusion and evasion of defense systems. Information on versions inside the cluster can map to CVE and vulnerabilities that can be exploited. Information on applications, tools and architectures can be used for competitors. Prometheus in the wild Title Prometheus collects and stores its metrics as time series data, i.e. metrics information is stored with the timestamp at which it was recorded, alongside optional key-value pairs called labels. Prometheus allows (and recommends) using basic authentication, but not enabled by default: https://prometheus.io/docs/operating/security/ Exposing open Prometheus endpoints to the Internet is a bad idea... and as every bad idea, it's highly adopted: What will we us to fingerprint Kubernetes? Title Two of the most widely used exporters offer most of the information that we need: Node ExporterKube State Metrics ● ●● ● ● ● ● ● Physical infrastructure Network interfaces Host OS & kernel Kubernetes components Hostnames and network topology Logical hierarchy Secrets location Applications (and versions) deployed Fingerprinting Physical Infrastructure Title Node Exporter: node_dmi_info bios_vendor: ● SeaBIOS ● Amazon EC2 bios_version: ● seabios-1.9.1-qemu-project.org ● 8f19b21 ● 1.0 bios_release: ● 1.0 bios_date: ● 10/16/2017 ● 04/01/2014 chassis_asset_tag: ● Amazon EC2 chassis_vendor: ● Amazon EC2 ● Alibaba Cloud system_vendor: ● Tencent Cloud ● Amazon EC2 ● Alibaba Cloud product_name: ● m5.xlarge ● Alibaba Cloud ECS product_version: ● pc-i440fx-2.1 board_vendor: ● Amazon EC2 board_asset_tag: ● i-00280f617XXXXX board_vendor: ● Smdbmds ● Amazon EC2 Fingerprinting network interfaces Title Node Exporter: node_network_info{device=~'eth.+'} { address="06:d5:XX:XX:XX:XX", broadcast="ff:ff:ff:ff:ff:ff", device="eth0", instance="172.31.XX.XX:9100", instance_az="us-west-2a", instance_id="i-XXXXX", instance_name="XXX-XXX", instance_type="c5.xlarge", instance_vpc="vpc-XXXXXXX", job="ec2_instances", operstate="up" } Fingerprinting network topology Title KSM: kube_node_info kube_service_info * on (service) group_left group by (service,type)(kube_service_spec_type{type="LoadBalancer"}) kube_ingress_info Node hostname Services in the cluster (specially load-balancers) ● namespace ● cluster IP ● node ● (application behind the service can be guessed by name of service/namespace) Ingresses in the cluster

BASTA! 2017, Mainz: Talk von Mario-Leander Reimer (@LeanderReimer, Cheftechnologe bei QAware). Cloud-Größen wie Google, Twitter und Netflix haben die Kernbausteine ihrer Infrastruktur quelloffen verfügbar gemacht. Das Resultat aus vielen Jahren Cloud-Erfahrung ist nun frei zugänglich, und jeder kann seine eigenen Cloud-nativen Anwendungen entwickeln – Anwendungen, die in der Cloud zuverlässig laufen und fast beliebig skalieren. Die einzelnen Bausteine wachsen zu einem großen Ganzen zusammen, dem Cloud-Native-Stack. In dieser Session stellen wir die wichtigsten Konzepte und aktuellen Schlüsseltechnologien kurz vor. Anschließend implementieren wir einen einfachen Microservice mit .NET Core und Steeltoe OSS und bringen ihn zusammen mit ausgewählten Bausteinen für Service-Discovery und Konfiguration schrittweise auf einem Kubernetes-Cluster zum Laufen.

Dok Talks #140 - Data protection of stateful environment

DoKC

Link to the full talk: https://youtu.be/GbBMX83EqZI https://go.dok.community/slack https://dok.community ABSTRACT OF THE TALK More and more we see stateful workloads pop up in Kubernetes clusters. These workloads generate data that is unique and is ephemeral. During this talk we will discuss the challenges of stateful workloads and how you can successfully protect BIO Working over a decade in IT as a technical expert for Veeam Software. Specializing in backup for the modern hybrid cloud. Passion for scripting and programming. Husband of Lena, father of Lev. KEY TAKE-AWAYS FROM THE TALK Data backup of Kubernetes. DR for Kubernetes

Container security within Cisco Container Platform

Sanjeev Rampal

Kubernetes 101 for_penetration_testers_-_null_mumbai

n|u - The Open Security Community

Cloud orchestration risks

Glib Pakharenko

Docker San Diego 2015-03-25

Casey Bisson

Docker on a laptop is easy, but Docker in the cloud is hard. What makes that transition so hard, and what can we do about it? How does this challenge affect the hosting infrastructure and application design? Casey will share lessons learned so far and further questions uncovered in Joyent’s work to build support for Docker in public and private cloud environments. See also http://www.meetup.com/Docker-San-Diego/events/221128898/ and http://www.meetup.com/Docker-Orange-County/events/221129001/

A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17

Mario-Leander Reimer

Cloud native applications are popular these days. They promise superior reliability and almost arbitrary scalability. They follow three key principles: they are built and composed as microservices. They are packaged and distributed in containers. The containers are executed dynamically in the cloud. But which technology is best to build this kind of application? This talk will be your guidebook. In this hands-on session, we will briefly introduce the core concepts and some key technologies of the cloud native stack and then show how to build, package, containerize, compose and orchestrate a cloud native showcase application on top of a cluster operating system such as Kubernetes or OpenShift. Throughout the session we will be using an off-the-shelf MIDI controller to visualize the concepts and to remote control the cluster. Container Days 2017 conference. @ConDaysEU #CDS17 #qaware #CloudNativeNerd @LeanderReimer

A hitchhiker‘s guide to the cloud native stack

QAware GmbH

Container Days 2017, Hamburg: Vortrag von Mario-Leander Reimer (@LeanderReimer, Cheftechnologe bei QAware). Abstract: Cloud-Größen wie Google, Twitter und Netflix haben die Kernbausteine ihrer Infrastruktur quelloffen verfügbar gemacht. Das Resultat aus vielen Jahren Cloud-Erfahrung ist nun frei zugänglich, und jeder kann seine eigenen Cloud-nativen Anwendungen entwickeln – Anwendungen, die in der Cloud zuverlässig laufen und fast beliebig skalieren. Die einzelnen Bausteine wachsen zu einem großen Ganzen zusammen, dem Cloud Native Stack. In dieser Session stellen wir die wichtigsten Konzepte und Schlüsseltechnologien vor und bringen dann eine Spring-Cloud-basierte Beispielanwendung schrittweise auf Kubernetes und DC/OS zum Laufen. Dabei diskutieren wir verschiedene praktikable Architekturalternativen.

Container Security Mmanagement

Suresh Thivanka Rupasinghe

Here Be Dragons: Security Maps of the Container New World

C4Media

Video and slides synchronized, mp3 and slide download available at URL http://bit.ly/1KjxPiO. Josh Bregman explores some of the unique security challenges created by both the development workflow and application runtime, explains why and how the current approaches in SecDevOps 1.0 are insufficient, and how SecDevOps 2.0 techniques including Software Defined Firewalls (SDF) provide a promising path forward for all parties involved. Filmed at qconnewyork.com. Josh Bregman is Information Security Architect and Executive Vice President for Technical Sales at Conjur Inc.

VMworld 2014: The Software-Defined Datacenter, VMs, and Containers

VMworld

Ivan Zhuravel and Ihor Khlaponin "DC/OS vs Kubernetes. Let the Fight Begin!"

LogeekNightUkraine

Architecting .NET solutions in a Docker ecosystem - .NET Fest Kyiv 2019

Alex Thissen

Conference: .NET Fest 2019 Location: Kyiv, Ukraine Abstract: You must have noticed how Docker and containers is playing a more and more important part in .NET development. Docker support is everywhere, so it should be easy to build solutions based on container technology, right? But, it takes a bit more to architect and create a .NET solution that use Docker at its core. Many questions arise: How do you design a solution architecture that fits well with containers? Would I use .NET or .NET Core? What is a proper way to migrate to such an architecture? What changes in the .NET implementation from pre-Docker solutions with micro-services? Where do container orchestrators fit in and how do I build and deploy my solutions on a Docker container cluster, such as Azure Kubernetes Service? These and many other questions will be answered in this session. You will learn how to design and architect your .NET solutions and get a flying start to create, build and run Docker-based containerized applications.

AWS re:Invent 2016: Securing Container-Based Applications (CON402)

Containers have had an incredibly large adoption rate since Docker was launched, especially from the developer community, as it provides an easy way to package, ship, and run applications. Securing your container-based application is now becoming a critical issue as applications move from development into production. In this session, you learn ways to implement storing secrets, distributing AWS privileges using IAM roles, protecting your container-based applications with vulnerability scans of container images, and incorporating automated checks into your continuous delivery workflow.

AWS re:Invent 2016: Securing Container-Based Applications (CON402)

Docker Azure Friday OSS March 2017 - Developing and deploying Java & Linux on...

Patrick Chanezon

20200113 - IBM Cloud Côte d'Azur - DeepDive Kubernetes

IBM France Lab

Secure Application Development in the Age of Continuous Delivery

Tim Mackey

As delivered at LinuxCon and ContainerCon in Berlin 2016. Traditionally, when datacenter operators talk about application security, they've tended to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment of micro-services, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily. In this session we’ll present: • How known vulnerabilities can make their way into production deployments • How deployment of vulnerable code can be minimized • How to determine the vulnerability status of a container • How to determine the risk associated with a specific package

Secure Application Development in the Age of Continuous Delivery

Black Duck by Synopsys

As delivered by Tim Mackey, Senior Technical Evangelist - Black Duck Software, at LinuxCon and ContainerCon in Berlin 2016. Traditionally, when datacenter operators talk about application security, they've tended to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment of micro-services, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily. In this session we’ll present: • How known vulnerabilities can make their way into production deployments • How deployment of vulnerable code can be minimized • How to determine the vulnerability status of a container • How to determine the risk associated with a specific package

How to Prevent Your Kubernetes Cluster From Being Hacked by Nico Meisenzahl

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Nico will show how to prevent your Kubernetes cluster from being hijacked by introducing you to best practices as well as useful open-source projects based on real-world examples. You’ll learn everything you need to know to build and run secure Kubernetes clusters including: - basics like shift left and container image security - ensure supply chain security - implement Kubernetes policies - introduce Kubernetes network security - rely on Container Runtime Security - many more… Don't miss this session to learn everything you need to know to securely run your Kubernetes-based workloads.

Container Security Scanning by Timo Pagel

n|u - The Open Security Community

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. The ClusterImageScanner detects images in Kubernetes clusters and provides fast feedback based on security scans. Security scans are for example image lifetime or detection of known vulnerabilities. This talk will give insights into: - The use cases of the ClusterImageScanner - The different scans - The architecture - A live demo The ClusterImageScannerScanner is OpenSource, get it from https://github.com/SDA-SE/cluster-image-scanner/.

Similar to Constellation - The first always encrypted Kubernetes by Moritz Eckert

OpenEBS Technical Workshop - KubeCon San Diego 2019

MayaData Inc

Cloud-native .NET Microservices mit Kubernetes

QAware GmbH

Dok Talks #140 - Data protection of stateful environment

DoKC

Container security within Cisco Container Platform

Sanjeev Rampal

Kubernetes 101 for_penetration_testers_-_null_mumbai

Cloud orchestration risks

Glib Pakharenko

Docker San Diego 2015-03-25

Casey Bisson

A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17

Mario-Leander Reimer

A hitchhiker‘s guide to the cloud native stack

QAware GmbH

Container Security Mmanagement

Suresh Thivanka Rupasinghe

Here Be Dragons: Security Maps of the Container New World

C4Media

VMworld 2014: The Software-Defined Datacenter, VMs, and Containers

VMworld

Ivan Zhuravel and Ihor Khlaponin "DC/OS vs Kubernetes. Let the Fight Begin!"

LogeekNightUkraine

Architecting .NET solutions in a Docker ecosystem - .NET Fest Kyiv 2019

Alex Thissen

AWS re:Invent 2016: Securing Container-Based Applications (CON402)

AWS re:Invent 2016: Securing Container-Based Applications (CON402)

Docker Azure Friday OSS March 2017 - Developing and deploying Java & Linux on...

Patrick Chanezon

20200113 - IBM Cloud Côte d'Azur - DeepDive Kubernetes

IBM France Lab

Secure Application Development in the Age of Continuous Delivery

Tim Mackey

Secure Application Development in the Age of Continuous Delivery

Black Duck by Synopsys

Similar to Constellation - The first always encrypted Kubernetes by Moritz Eckert (20)

OpenEBS Technical Workshop - KubeCon San Diego 2019

Cloud-native .NET Microservices mit Kubernetes

Dok Talks #140 - Data protection of stateful environment

Container security within Cisco Container Platform

Kubernetes 101 for_penetration_testers_-_null_mumbai

Cloud orchestration risks

Docker San Diego 2015-03-25

A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17

A hitchhiker‘s guide to the cloud native stack

Container Security Mmanagement

Here Be Dragons: Security Maps of the Container New World

VMworld 2014: The Software-Defined Datacenter, VMs, and Containers

Ivan Zhuravel and Ihor Khlaponin "DC/OS vs Kubernetes. Let the Fight Begin!"

Architecting .NET solutions in a Docker ecosystem - .NET Fest Kyiv 2019

AWS re:Invent 2016: Securing Container-Based Applications (CON402)

Docker Azure Friday OSS March 2017 - Developing and deploying Java & Linux on...

20200113 - IBM Cloud Côte d'Azur - DeepDive Kubernetes

Secure Application Development in the Age of Continuous Delivery

More from ContainerDay Security 2023

How to Prevent Your Kubernetes Cluster From Being Hacked by Nico Meisenzahl

Container Security Scanning by Timo Pagel

Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. You’ve been hearing a lot about security best practices, but you’re not convinced they can really make a difference? Do you think your resources are safe only because nobody would notice your random IP address? If so – join my session! I’ll show you real-life attack scenarios to convince you that misconfigurations can have dire consequences.

Container Security Scanning by Timo Pagel

How to Prevent Your Kubernetes Cluster From Being Hacked by Nico Meisenzahl

Hardening automation with Kubespray by Alessio Greggi

Enhancing Network and Runtime Security with Cilium and Tetragon by Raymond De...

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Cilium is the next generation, eBPF powered open-source Cloud Native Networking solution, providing security, observability, scalability, and superior performance. Cilium is an incubating project under CNCF and the leading CNI for Kubernetes. In this session we will introduce the fundamentals of Cilium Network Policies and the basics of application-aware and Identity-based Security. We will discuss the default-allow and default-deny approaches and visualize the corresponding ingress and egress connections. Using the Network Policy Editor we will be able to demonstrate how a Cilium Network Policy looks like and what they mean on a given Kubernetes cluster. Additionally, we will walk through different examples and demonstrate how application traffic can be observed with Hubble and show how you can use the Network Policy Editor to apply new Cilium Network Policies for your workloads. Finally, we’ll demonstrate how Tetragon provides eBPF-based transparent security observability combined with real-time runtime enforcement.

Container Security - Let's see Falco and Sysdig in Action by Stefan Trimborn

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Containers are awesome. The technology finds more and more adaptation in our daily IT lifes. They are fast, agile and shareable. All those postives bring a downsite to it - visibility. Can I trust every container content? Is my container behaving like it should? It's to fast, how can I catch anomalities? We want to tackle those questions in our session and show you what Falco and Sysdig can do for you to win back container visibility without any loss of container benefits.

Constellation - The first always encrypted Kubernetes by Moritz Eckert

Cloud Hacking Scenarios by Michał Brygidyn

Lines of Defense - Securing your Kubernetes Clusters by Koray Oksay

Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Kubernetes has become the de facto standard for container orchestration, and it is being widely adopted by organizations of all sizes. However, as with any complex system, there are a number of security challenges that need to be addressed in order to properly secure a Kubernetes deployment. In his talk, Koray will first show you some security problem areas in Kubernetes and then give an overview of various security tools such as image screening and auditing. You will learn how to run Kubernetes clusters securely and how to proactively counteract security challenges.

More from ContainerDay Security 2023 (11)

How to Prevent Your Kubernetes Cluster From Being Hacked by Nico Meisenzahl

Container Security Scanning by Timo Pagel

Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •

Container Security Scanning by Timo Pagel

How to Prevent Your Kubernetes Cluster From Being Hacked by Nico Meisenzahl

Hardening automation with Kubespray by Alessio Greggi

Enhancing Network and Runtime Security with Cilium and Tetragon by Raymond De...

Container Security - Let's see Falco and Sysdig in Action by Stefan Trimborn

Constellation - The first always encrypted Kubernetes by Moritz Eckert

Cloud Hacking Scenarios by Michał Brygidyn

Lines of Defense - Securing your Kubernetes Clusters by Koray Oksay

Recently uploaded

JMeter webinar - integration with InfluxDB and Grafana

RTTS

Watch this recorded webinar about real-time monitoring of application performance. See how to integrate Apache JMeter, the open-source leader in performance testing, with InfluxDB, the open-source time-series database, and Grafana, the open-source analytics and visualization application. In this webinar, we will review the benefits of leveraging InfluxDB and Grafana when executing load tests and demonstrate how these tools are used to visualize performance metrics. Length: 30 minutes Session Overview ------------------------------------------- During this webinar, we will cover the following topics while demonstrating the integrations of JMeter, InfluxDB and Grafana: - What out-of-the-box solutions are available for real-time monitoring JMeter tests? - What are the benefits of integrating InfluxDB and Grafana into the load testing stack? - Which features are provided by Grafana? - Demonstration of InfluxDB and Grafana using a practice web application To view the webinar recording, go to: https://www.rttsweb.com/jmeter-integration-webinar

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Knowledge engineering: from people to machines and back

Elena Simperl

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

Jeffrey Haguewood

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams. Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Generating a custom Ruby SDK for your web service or Rails API using Smithy

g2nightmarescribd

Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.

DevOps and Testing slides at DASA Connect

Kari Kakkonen

When stars align: studies in data quality, knowledge graphs, and machine lear...

Elena Simperl

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

Bits & Pixels using AI for Good.........

Alison B. Lowndes

Monitoring Java Application Security with JDK Tools and JFR Events

Ana-Maria Mihalceanu

Designing Great Products: The Power of Design and Leadership by Chief Designe...

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...

Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...

UiPathCommunity

💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™: See how to accelerate model training and optimize model performance with active learning Learn about the latest enhancements to out-of-the-box document processing – with little to no training required Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath. Speakers: 👨‍🏫 Andras Palfi, Senior Product Manager, UiPath 👩‍🏫 Lenka Dulovicova, Product Program Manager, UiPath

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

Securing your Kubernetes cluster_ a step-by-step guide to success !

KatiaHIMEUR1

Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster. However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks. In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.

From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...