Keeping Kubernetes Safe: The Lowdown on Locked Namespaces - Marco De Benedictis, ControlPlane
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2024-03-23

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon North America in Salt Lake City from November 12 - 15, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Keeping Kubernetes Safe: The Lowdown on Locked Namespaces - Marco De Benedictis, ControlPlane

Kubernetes namespaces are widely used by developers and infrastructure maintainers to group resources within clusters, yet their role as pivotal security boundaries often gets overlooked. Many well-established and upcoming Kubernetes features rely on secure namespace management, from in-cluster DNS resolution to Network Policies, Limit Ranges, Pod Security Standards, and Gateway API Cross-Namespace Routing. The talk will investigate the implications of compromise within a cluster if an adversary successfully tampers existing namespaces or crafts new ones by delving into real-world use cases, including multi-tenancy and cluster-native policy enforcement. A spectrum of mitigations and best practices to lock down namespaces effectively will be presented, covering strategies from Role-Based Access Control (RBAC) to advanced object validation using admission controllers, including secure approaches with namespace templating in multi-tenant environments.