Back To Schedule
Tuesday, May 21 • 14:00 - 14:35
Fine-Grained Permissions in Kubernetes: What’s Missing, and How to Fix That - Vallery Lancey, Lyft & Seth McCombs, Triller

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Feedback form is now closed.
In this talk, we will walk through a number of common scenarios where Kubernetes lacks sufficient access control tools, or where access control is often not properly applied. For example, it is common for a team to own a subset of services in a namespace, yet RBAC permissions grant that team access to other pods within the namespace.

We will demonstrate a number of solutions available for specific problems, such as pod network policies, the open policy agent, custom controllers that gate API functionality.

We will also discuss problems with the namespace permission model, and possible alternatives. Namespaces create an arbitrary boundary around resources, which creates the need to then bridge those boundaries. We will demonstrate ideas for bridging namespace networks, and posix-style objection permissions within a namespace.

avatar for Vallery Lancey

Vallery Lancey

Site Reliability Engineer, Apple
Vallery Lancey is an infrastructure-minded software engineer. She enjoys watching things break, and figuring out how to make them break less.

Tuesday May 21, 2019 14:00 - 14:35 CEST
Hall 8.0 B1