Scribd Logo
Upload

Welcome to Scribd!

  • 11 views

    Kubecon DTC 2016

    Uploaded by

    Matthew Garrett
    This document discusses integrating trusted computing capabilities into Kubernetes to verify the security of system states. It proposes using a Trusted Platform Module to provide unique system identities and cryptographically verify states through attestation. This would allow authenticating nodes based on their TPM-verified state before providing access. An authentication controller could initially authenticate using the TPM and later an admission controller could validate state on node operations. A proof of concept measures initial container states and provides a cryptographically verifiable audit trail. The document questions whether this integration should be included in the Kubernetes codebase.

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Kubecon DTC 2016

    Uploaded by

    Matthew Garrett
    11 views25 pages
    This document discusses integrating trusted computing capabilities into Kubernetes to verify the security of system states. It proposes using a Trusted Platform Module to provide unique system identities and cryptographically verify states through attestation. This would allow authenticating nodes based on their TPM-verified state before providing access. An authentication controller could initially authenticate using the TPM and later an admission controller could validate state on node operations. A proof of concept measures initial container states and provides a cryptographically verifiable audit trail. The document questions whether this integration should be included in the Kubernetes codebase.

    Original Description:

    Original Title

    Kubecon Dtc 2016

    Copyright

    © © All Rights Reserved

    Available Formats

    ODP, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses integrating trusted computing capabilities into Kubernetes to verify the security of system states. It proposes using a Trusted Platform Module to provide unique system identities and cryptographically verify states through attestation. This would allow authenticating nodes based on their TPM-verified state before providing access. An authentication controller could initially authenticate using the TPM and later an admission controller could validate state on node operations. A proof of concept measures initial container states and provides a cryptographically verifiable audit trail. The document questions whether this integration should be included in the Kubernetes codebase.

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as odp, pdf, or txt
    11 views25 pages

    Kubecon DTC 2016

    Uploaded by

    Matthew Garrett
    This document discusses integrating trusted computing capabilities into Kubernetes to verify the security of system states. It proposes using a Trusted Platform Module to provide unique system identities and cryptographically verify states through attestation. This would allow authenticating nodes based on their TPM-verified state before providing access. An authentication controller could initially authenticate using the TPM and later an admission controller could validate state on node operations. A proof of concept measures initial container states and provides a cryptographically verifiable audit trail. The document questions whether this integration should be included in the Kubernetes codebase.

    Copyright:

    © All Rights Reserved
    Download as ODP, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as odp, pdf, or txt
    of 25

    Integrated Trusted Computing in

    Kubernetes

    Matthew Garrett
    @mjg59 | mjg59@coreos.com | coreos.com
    Secure runtimes require a secure base
    How do we trust a system?
    Trusted Computing
    Trusted Platform Module
    Unique per-system identity
    Cryptographically verifiable system state
    “Attestation”
    How does this fit into Kubernetes?
    Verify system state before providing access
    Two-pronged approach
    Authentication Controller
    Initial authentication is TPM based
    Attestation is slow :(
    On valid auth, provide secrets
    Admission Controller
    Validate state on node operations
    Can we go further?
    Measure initial container state
    Cryptographically verifiable audit trail
    Proof of concept implementation
    JSON-based policy description
    Should this be in-tree?
    https://github.com/mjg59/kubernetes
    Matthew Garrett
    @mjg59 | mjg59@coreos.com | coreos.com

    Thank you!
    We’re hiring in all departments!
    Email: careers@coreos.com Positions: coreos.com/careers

    You might also like