Skip to content

My Wiki

Security

Security¶

569 talks across 34 events, oldest first: 49 case studies where an organization reports its own experience, plus concept talks and tutorials.

Keywords: security, supply chain, sbom, sigstore, cosign, falco, opa, gatekeeper, kyverno, policy, rbac, spiffe, spire, zero trust, vulnerability, cve, secrets, vault, compliance, runtime security, admission control (edit under categories: in wiki.yaml).

Over time¶

Year	Talks	Case studies
2016	5	1
2017	14	0
2018	53	7
2019	60	6
2020	44	1
2021	47	3
2022	55	6
2023	92	7
2024	87	8
2025	69	4
2026	43	6

Organizations with case studies¶

Shopify (5), Standard Chartered, Zachary Arnold & Austin Adams' employer, ControlPlane, Nav, HP, Alibaba Cloud, Ant Financial, Goldman, Yelp, Capital One, DoD, Elastisys, SPIFFE Steering Committee, Buoyant, Inc, GitHub, Lunar, Palantir, DE-CIX, eBay, Netflix, ClickHouse, Preferred Networks

Talks by event¶

2016 · KubeCon + CloudNativeCon North America 2016 (Seattle)¶

case study · Evolving Dev and Ops with Kubernetes: Enterprise Adoption for Security, Speed, and Ease
concept · A Security State of Mind: Continuous Security with Kubernetes by Chris Van Tuin, Red Hat
concept · Navigating the Container Jungle by Casey Davenport, Tigera. Tigera's Casey Davenport gives an overview of container networking options and how to choose among them.
concept · Sentinel: A Platform for Fine-grained Application Security by Sudheendra Murthy, eBay, Inc.
concept · A Security State of Mind: Compliance and Vulnerability Audits for Containers by Chris Van Tuin

2017 · KubeCon + CloudNativeCon Europe 2017 (Berlin)¶

concept · Network-independent ACLs: Why Security Shouldn't Depend on Your Network [I] - Bernard Van De Walle
concept · Audit in Kubernetes Now, and in the Future [B] - Maciej Szulik, Red Hat. Covers how Kubernetes auditing works and where it is headed.

2017 · KubeCon + CloudNativeCon North America 2017 (Austin)¶

concept · The Power of Application Intent Analysis for Container Security [I] - John Morello, Twistlock
concept · Introducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I] - Evan Gilman
concept · IAM on Hybrid Cloud: Next Generation Security Model to Create an Interoperable Cloud [I]
concept · Kubernetes, Metadata and You [I] - Liz Rice, Aqua Security & Gareth Rushgrove, Puppet. Explains how metadata in Kubernetes can be used for security and operations.
concept · Vault and Secret Management in Kubernetes [I] - Armon Dadgar, HashiCorp
concept · Securing Cluster Networking with Network Policies - Ahmet Balkan, Google. Explains how to use Kubernetes Network Policies to secure cluster networking.
concept · Deploying Kubernetes Without Scaring Off Your Security Team - Paul CzarkowskI & Major Hayden
concept · Multi-Tenancy Support & Security Modeling with RBAC and Namespaces - Fred Vong & Michael Y. Chen
concept · Compliance and Identity Management in Kubernetes [I] - Marc Boorshtein, Tremolo Security, Inc.. Discusses identity management and compliance requirements in Kubernetes.
concept · Istio’s Mixer: Policy Enforcement with Custom Adapters - Limin Wang, Google & Torin Sandall, Styra
concept · Effective RBAC - Jordan Liggitt, Red Hat
concept · Real Security for Services on Kubernetes [I] - Eric Wang & Yun Zhang, Databricks

2018 · KubeCon + CloudNativeCon China 2018 (Shanghai)¶

case study · Compliance as Code - Lessons Learned From Regulated Organizations - Sergiu Bodiu, Standard Chartered — Standard Chartered
concept · Managing RBAC Cross Multiple Kubernetes Clusters - Alena Prokharchyk, Rancher Labs, Inc.
concept · Deep Dive: Falco - Jorge Salamero Sanz, Sysdig
concept · Istio Certificate Management Through Vault - Lei Tang & Yonggang Liu, Google
concept · The State of Your Supply Chain - Andrew Martin, ControlPlane & Maya Kaczorowski, Google
concept · Deep Dive: Kubernetes Policy WG - Torin Sandall, Styra & Da Ma, Zhipeng Huang, Huawei
concept · Intro: SAFE (A Cloud Native Security Working Group) - Liz Rice, Aqua Security
concept · Intro: Kubernetes Policy WG - Zhipeng Huang & Hui Wang, Huawei
concept · Turtles All the Way Down: Managing Kubernetes Secrets - Maya Kaczorowski & Alexandr Tcherniakhovski
concept · Intro: Falco - Jorge Salamero Sanz, Sysdig
concept · Intro: Open Policy Agent - Torin Sandall, Styra

2018 · KubeCon + CloudNativeCon Europe 2018 (Copenhagen)¶

case study · Case study: How Containers Makes Security and Compliance Instantly Easier - John Morello
case study · Achieving High Security at Scale with Microservices - Zachary Arnold & Austin Adams — Zachary Arnold & Austin Adams' employer. Speakers describe how they achieved high security across a large microservices deployment in their own organization.
case study · From Kubelet to Istio: Kubernetes Network Security Demystified - Andrew Martin, ControlPlane — ControlPlane
concept · Kubernetes Policy WG Intro – Zhipeng Huang, Huawei (Any Skill Level)
concept · SPIFFE Project Intro - Andrew Jessup & Emiliano Berenbaum, Scytale, Inc. (Any Skill Level). Introduces the SPIFFE project and how it provides workload identity.
concept · Improving your Kubernetes Workload Security - Samuel Ortiz & Fabian Deutsch
concept · Establishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
concept · SPIFFE Deep Dive - Andrew Jessup, Emiliano Berenbaum, Scytale, Inc., & Neel Shah, VMware
concept · Entitlements: Understandable Container Security Controls - Justin Cormack & Nassim Eddequiouaq
concept · OPA: The Cloud Native Policy Engine - Torin Sandall, Styra (Intermediate Skill Level)
concept · Kubernetes Policy WG Deep Dive - Zhipeng Huang, Huawei (Intermediate Skill Level)
concept · TL;DR NIST Container Security Standards - Elsie Phillips, CoreOS (Beginner Skill Level)
concept · Kubernetes Runtime Security: What Happens if a Container Goes Bad? - Jen Tong & Maya Kaczorowski
concept · Open Policy Agent Deep Dive – Tim Hinrichs & Torin Sandall, Styra (Intermediate Skill Level). Intermediate deep dive into Open Policy Agent and its policy language.
concept · Lightning Talk: Why you Should Really Pay Attention to K8S Security Best Practices - Benjy Portnoy
concept · Lightning Talk: I Got your RBAC - kube-rbac-proxy - Frederic Branczyk, CoreOS (Any Skill Level)
concept · Applying Least Privileges through Kubernetes Admission Controllers - Benjy Portnoy, Aqua Security. Shows how to apply least privilege using Kubernetes admission controllers.
concept · Completely Securing the Software Supply Chain using Grafeas + in-toto - Lukas Puehringer. Shows how Grafeas and in-toto combine to secure the whole software supply chain.
panel · Panel Discussion: Modern App Security Requires Containers – Moderated by Sean Michael Kerner. Panel discussing why modern application security depends on containers.

2018 · KubeCon + CloudNativeCon North America 2018 (Seattle)¶

case study · Towards Trading on Kubernetes: Operating Multi-Tenant and Se... - Andrew Kochut & Javier Diaz-Montes. Describes operating multi-tenant, secure Kubernetes for trading workloads.
case study · How We Survived Our First PCI/HIPAA Compliant Check with Kubernetes - Travis Jeppson, Nav — Nav. Nav shares how it passed its first PCI/HIPAA compliance check while running on Kubernetes.
case study · Shopify’s $25k Bug Report, and the Cluster Takeover That Didn’t... - Greg Castle & Shane Lawrence — Shopify. Shopify recounts a $25k bug report that could have led to a cluster takeover and how it was found and fixed.
concept · Public Technical Oversight Committee (TOC) Meeting – Moderated by Liz Rice, Aqua Security
concept · Water, Water, Everywhere: Making Kubernetes Audit Logs Potable - Kate Kuchin, Heptio. Explains how to make Kubernetes audit logs usable by configuring and processing them.
concept · Intro: TUF/Notary - Justin Cappos, NYU & Justin Cormack, Docker. Introduction to TUF and Notary projects for secure software update and content distribution.
concept · This Year, It’s About Security - Maya Kaczorowski & Brandon Baker, Google
concept · Intro: Falco - Loris Degioanni, Sysdig
concept · Securing Application Telemetry & Tracing with SPIFFE and Envoy - Sabree Blackmon, Docker
concept · Intro: SPIFFE - Andrew Jessup & Daniel Feldman, Scytale
concept · Implementing Least Privilege Security and Networking with BPF on Kubernetes - Arvind Soni, Covalent. Shows how to implement least-privilege security and networking on Kubernetes with BPF.
concept · So You Want to Run Vault in Kubernetes? - Seth Vargo, Google. Covers how to run HashiCorp Vault on Kubernetes and the considerations involved.
concept · Navigating Workload Identity in Kubernetes - Michael Danese, Google & Spike Curtis, Tigera. Explains approaches to giving Kubernetes workloads verifiable identity and how they compare.
concept · Intro: Open Policy Agent - Torin Sandall, Styra
concept · Deep Dive: Open Policy Agent - Torin Sandall, Styra
concept · Getting Your Hands "Dirty" in Container Sandbox - Ariel Shuper, Aqua Security
concept · Security Considerations for Container Runtimes - Daniel Walsh, Red Hat
concept · Container Security & Multi-Tenancy Tales from Kata & Nabla - Ricardo Aravena & James Bottomley, IBM
concept · Deep Dive: SPIFFE - Emiliano Bernbaum & Andrew Harding, Scytale. Deep dive into SPIFFE and how it provides workload identity.
concept · Deep Dive: Falco - Mark Stemm, Sysdig
concept · Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei
concept · Scrutinizing SPIRE to Sensibly Strengthen SPIFFE Security- Matt Moyer, Heptio & Evan Gilman, Scytale. A security-focused look at SPIRE's design and how it strengthens SPIFFE-based identity.
tutorial · Tutorial: Building Security into Kubernetes Deployment Pipelines

2019 · KubeCon + CloudNativeCon China 2019 (Shanghai)¶

case study · Lightning Talk: How We Use Istio and OPA for Authorization - Lin Tao, HP — HP
case study · No More Chaos: Audit and Inspect Kubernetes at Scale - 陈杰, 阿里云 & 马金晶, 蚂蚁金服（杭州）网络技术有限公司 — Alibaba Cloud, Ant Financial. Alibaba Cloud and Ant Financial present how they audit and inspect Kubernetes clusters at scale.
concept · Intro: Open Policy Agent - Torin Sandall, Styra
concept · Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei
concept · Gatekeeper: Flexible, Shareable Policy for Kubernetes - Craig Peters, Mircosoft. Introduces Gatekeeper as a flexible, shareable policy framework for Kubernetes.
concept · How SPIFFE Helps Istio in Service Mesh Federation - Yonggang Liu & Wencheng Lu, Google
concept · Intro: CNCF Security SIG - Brandom Lum, IBM
concept · The Secure Design in Zephyr and its Implementation in Synopsys ARC Processor - Wayne Ren. Covers Zephyr's secure design and how it is implemented on the Synopsys ARC processor.
concept · Developing Open Source for Safety and Security - Kate Stewart, Linux Foundation
concept · The FOSSology Project – Open Source Software for Open Source License Compliance - Anupam Ghosh
concept · Improving Security while Reducing Toil with DevSecOps - Paul Czarkowski, Pivotal
concept · Intro: Falco - Kaizhe Huang, Sysdig. Introduction to the Falco runtime security project.
concept · Preventing DMA Attacks from Thunderbolt Devices - Lu Baolu, Intel. Explains how to prevent DMA attacks from Thunderbolt devices.

2019 · KubeCon + CloudNativeCon Europe 2019 (Barcelona)¶

case study · 5 Simple Steps To Simplifying Your Compliance Journey With a Service Mesh – Granville Schmidt
case study · Uber x Security: Why and How We Built Our Workload Identity Platform - Tyler Julian & Daniel Feldman
concept · Intro: SPIFFE - Emiliano Bernbaum & Scott Emmons, Scytale
concept · Using eBPF to Bring Kubernetes-Aware Security to the Linux Kernel - Dan Wendlandt, Isovalent. Describes using eBPF to give the Linux kernel Kubernetes-aware security enforcement.
concept · Envoy SDS: Fortifying Istio Security - Yonggang Liu & Quanjie Lin, Google
concept · Intro: Open Policy Agent - Rita Zhang, Microsoft & Max Smythe, Google
concept · Intro: CNCF Security SIG – Sarah Allen & Jeyappragash Jeyakeerthi, Tetrate.io
concept · Authentication and Security in gRPC Microservices - Jan Tattermusch, Google
concept · Intro: Falco - Jorge Salamero Sanz, Sysdig
concept · Unit Testing Your Kubernetes Configurations Using Open Policy Agent - Gareth Rushgrove, Docker
concept · Kubernetes Security and How to Fix K8s Cluster at Scale - Simon Pearce & Sebastian Scheele. Covers Kubernetes security issues and how to fix clusters at scale.
concept · Deep Dive: Falco - Michael Ducy, Sysdig
concept · Zero Trust Service Mesh with Calico, SPIRE, and Envoy - Shaun Crampton & Evan Gilman
concept · Deep Dive: SPIFFE - Scott Emmons & Emiliano Bernbaum, Scytale
concept · Deep Dive: Open Policy Agent - Torin Sandall & Tim Hinrichs, Styra
concept · Inside the CNCF Project Security Reviews - Justin Cormack, Docker. Describes how CNCF project security reviews work and what they find.
concept · Deep Dive: CNCF Security SIG – Justin Cappos, New York University & Zhipeng Huang, Huawei
concept · Secrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8s - Rita Zhang
concept · Protecting the Data Lake - Ash Narkar, Styra, Inc. Shows how to use OPA to protect data lakes through policy-based authorization.
concept · Securing Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE - Evan Gilman, Scytale, Inc.
concept · DIY Pen-Testing for Your Kubernetes Cluster - Liz Rice, Aqua Security
concept · Deep Dive: Auth SIG - Mo Khan & Matt Rogers, Red Hat. SIG Auth deep dive on the Kubernetes authentication and authorization request flow and authenticator semantics.
concept · Intro + Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei & Erica Von Buelow, Red Hat
concept · Tailor-Made Security: Building a Kubernetes Specific Hypervisor - Samuel Ortiz & Andreea Florescu
concept · Kubernetes + Encrypted Memory = Security * Privacy - Harshal Patil & Pradipta Banerjee, IBM
tutorial · Tutorial: Building Security into Kubernetes Deployment Pipelines - Michael Hough & Sam Irvine

2019 · KubeCon + CloudNativeCon North America 2019 (San Diego)¶

case study · Kubernetes Policy Enforcement Using OPA At Goldman Sachs - Miguel Uzcategui & Tim Hinrichs — Goldman
case study · How Yelp Moved Security From the App to the Mesh with Envoy and OPA - Daniel Popescu & Ben Plotnick — Yelp
concept · Lightning Talk: CRDs All the Way Down – Using OPA for Complex CRD Validation and... Puja Abbassi
concept · Walls Within Walls: What if Your Attacker Knows Parkour? - Tim Allclair & Greg Castle, Google. Explains layered defenses against attackers who escape from containers in Kubernetes.
concept · Applying Policy Throughout The Application Lifecycle with Open Policy Agent - Gareth Rushgrove, Snyk
concept · The Devil in the Details: Kubernetes’ First Security Assessment - Aaron Small & Jay Beale
concept · OPA Introduction & Community Update - Rita Zhang, Microsoft & Patrick East, Styra
concept · Enforcing Automatic mTLS With Linkerd and OPA Gatekeeper - Ivan Sim, Buoyant & Rita Zhang, Microsoft
concept · Five Things You Didn’t Know You Could Do with SPIFFE and SPIRE - Andrew Jessup & Andrés Vega. Shows five lesser-known capabilities of SPIFFE and SPIRE.
concept · Hardware-based KMS Plug-in to Protect Secrets in Kubernetes - Raghu Yeluri & Haidong Xia, Intel
concept · Securing the Software Supply Chain with in-toto - Santiago Torres-Arias & Justin Cappos, NYU. Explains how in-toto secures the software supply chain.
concept · Securing Your Services with Authentication, Authorization, and RBAC in gRPC - Luis Pabón, Portworx
concept · Cloud Native Runtime Security with Falco - Kris Nova, Sysdig & Abhinav Srivastava, Frame.io
concept · Knative - The Security Platypus? - Ariel Shuper, Aqua Security
concept · Enforcing Service Mesh Structure using OPA Gatekeeper - Sandeep Parikh, Google. Shows how to enforce service mesh structure and configuration with OPA Gatekeeper.
concept · Walk-through: Debugging an RBAC Problem in Istio (But Without the Swearing) - Matt Turner
concept · Securing Communication Between Meshes and Beyond with SPIFFE Federation - Evan Gilman & Oliver Liu
concept · OPA Deep Dive - Tim Hinrichs, Styra & Torin Sandall, Styra
concept · Scaling SPIRE for Performance and Availability - Tyler Julian, Uber
concept · On the Security of Copying To and From Live Containers - Ariel Zelivansky & Yuval Avrahami
concept · Deep Dive: Harbor - Enterprise Cloud-native Artifact Registry - Steven Zou & Daniel Jiang. A deep dive into Harbor's architecture and features.

2020 · KubeCon + CloudNativeCon Europe 2020 - Virtual ¶

case study · Going Containerless with WebAssembly - Kevin Hoffman, Capital One — Capital One. Capital One describes its exploration of running workloads with WebAssembly instead of containers.
concept · Using SOPS, Kube Secrets and a CD Pipeline For Secure Configuration - Tom Hipwell, Bulb
concept · Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security
concept · Cloud Native Policy Deep Dive - Zhipeng Huang, Huawei & Erica von Buelow, Red Hat
concept · How This Innocent Image Had a Party in My Cluster - Amir Jerbi & Itay Shakury, Aqua Security
concept · Hey, Did You Hear About This New CVE? - A Vulnerabilit... Andrew Lytvynov & Alexandr Tcherniakhovski
concept · Network Isolation and Security Policies for Kubernetes Bare-meta... Girish Moodalbail & Liel Shoshan
concept · Notary v2 Introduction and Status Report - Justin Cormack, Docker & Omar Paul, Amazon. Introduction and status report on Notary v2 for signing container artifacts.
concept · Open Policy Agent Introduction - Rita Zhang, Microsoft & Patrick East, Styra
concept · How to Work in Cloud Native Security: Demystifying the Security Role - Justin Cormack, Docker
concept · Open Policy Agent Deep Dive - Tim Hinrichs & Ash Narkar, Styra
concept · Running SPIRE In Large Scale, Enterprise-Grade Environments - Andrew Harding, HPE
concept · Securing Your Healthcare Data with OPA - Martin Pratt, Medudoc & Ash Narkar, Styra
concept · Seccomp Security Profiles and You: A Practical Guide - Duffie Cooley, VMware
concept · Sponsor Demo: Palo Alto Networks - Get started with Cloud Native Security - OPA
concept · Making Compliance Cloud Native - Ann Wallace & Zeal Somani, Google. Discusses approaches to making compliance cloud native.
concept · Using Kubernetes Secrets in GitOps Workflows Securely - Seth Vargo & Alex Tcherniakhovski, Google. Explains approaches for securely handling Kubernetes secrets in GitOps workflows.
concept · CRI-O: Deep Diving into the Security - Sascha Grunert, SUSE & Daniel Walsh, Red Hat
concept · How Many CPU Cycles I Need to Invest in Cloud Native Security? - Ben Hirschberg, CyberArmor
concept · Owned By Statistics: How Kubeflow & MLOps Can Help Secure Your ML Workloads - David Aronchick. Shows how Kubeflow and MLOps practices can help secure ML workloads.
concept · Help! My Cluster Is On The Internet: Container Security Fundamentals - Samuel Davidson, Google
concept · Mutual TLS Adoption Made Simple, Safe and Secure - Lizan Zhou, Tetrate & Jianfei Hu, Google. Maintainers explain why mutual TLS is hard to adopt and how Istio API improvements make adoption simpler and safer.
concept · Save Your Services from Sneaky Snoops With SPIFFE? - Daniel Feldman, Scytale
concept · Easy, Secure and Fast - Using NATS for Data Streams and Services - Colin Sullivan, Synadia. Introduces using NATS for secure, fast data streams and services.
concept · in-toto: Securing the Entire Software Supply Chain - Santiago Torres, NYU
concept · The Common Configuration Scoring System for Kubernetes Security - Julien Sobrier, Octarine
tutorial · Tutorial: Getting Started With Cloud Native Security - Liz Rice, Aqua Security & Michael Hausenblas
tutorial · Intro to Falco: Intrusion Detection for Containers - Shane Lawrence, Shopify
panel · Panel: Security Is Not A Uni... Jay Beale, Marlow Weston, Trupti Shiralkar, Aeva Black & Sarah Young. Panel discussing why security is not a universal one-size-fits-all concern and how teams should approach it.
panel · Panel: Kubernetes and Cloud Native Security: A State of the Union - Rags Srinivas. Panel on the state of Kubernetes and cloud native security.
keynote · From Infrastructure Bro to Hacker Chick: A Cloud Native Journey - Kris Nóva, Independent. Kris Nóva shares a personal story about moving from infrastructure engineering to security and hacking.

2020 · KubeCon + CloudNativeCon North America 2020 - Virtual ¶

concept · Using Open Policy Agent to Meet Evolving Policy Requirements - Jeremy Rickard, VMware
concept · Uniform Workload Identity Everywhere: SPIRE Integrations and Extensibility - Ryan Turner, Uber
concept · Scaling to Millions of ML Models to Solve the Problems of SRE and Security - Sandeep Pombra. Describes scaling to millions of ML models to address SRE and security problems.
concept · Customizing OPA for a "Perfect Fit" Authorization Sidecar - Patrick East, Styra
concept · Selecting the Right Identity Provider for Kubernetes: A Comparative Survey - Cameron Seader, SUSE. Compares identity provider options for Kubernetes authentication.
concept · Secure Policy Distribution With OPA - Ash Narkar, Styra
concept · Bypass Falco - Leonardo Di Donato, Sysdig
concept · DevOps All the Things: Creating a Pipeline to Validate Your OPA Policies - Goran Osim
concept · Kubernetes-native Security with Starboard - Liz Rice & Daniel Pacak, Aqua Security
concept · Security Kill Chain Stages in a 100k+ Daily Container Environment with Falco - Natch Ruengsakulrach
concept · Open Policy Agent Intro - Patrick East, Styra & Max Smythe, Google. Introduces Open Policy Agent and how it enforces policy in Kubernetes, including Gatekeeper.
concept · Notary v2: Redesigning the Secure Supply Chain for Containers - Justin Cormack & Steve Lasker
concept · A Special Interest in Cloud Native Security - Emily Fox, National Security Agency & Brandon Lum

2021 · Cloud Native TV at KubeCon + CloudNativeCon North America 2021 ¶

concept · Cloud Native Security Con's Capture the Flag Live Stream - Part 1
concept · Cloud Native Security Con's Capture the Flag Live Stream - Part 2

2021 · KubeCon + CloudNativeCon + Open Source Summit China 2021 ¶

concept · Zero Trust Network Turnkey Solution to Support Zero Trust Service Mesh - Hongjun Ni & Pan Zhang
concept · Redteam Views: Security Practice of K8s Cluster Administrator - Zebin Zhou, Tencent
concept · Open Policy Agent Deep Dive - Anders Eknert, Styra
concept · Kubernetes Multi-Cluster and Multi-Tenancy With RBAC and KubeFed - Hongming Wan, QingCloud
concept · How to Build Your Cybersecurity Toolkits with Open Source Tools - Yu Chen, Aqua Security. Explains how to assemble a cybersecurity toolkit from open source tools.

2021 · KubeCon + CloudNativeCon Europe 2021 ¶

case study · How DoD Uses K8s & Flux to Achieve Compliance & Deployment Consistency - M. Medellin & G. Tillman — DoD
case study · Compliance Beyond Security: a Cloud Native GDPR Implementation Experience - Johan Tordsson — Elastisys. Elastisys shares its experience implementing GDPR compliance on a cloud native platform.
concept · Securing Content Distribution with The Update Framework (TUF) - Lukas Puehringer & Joshua Lock. Explains how TUF secures software content distribution and its recent developments.
concept · Notary v2: Supply Chain Security for Containers - Justin Cormack, Docker & Steve Lasker, Microsoft
concept · Open Policy Agent Intro - Ash Narkar, Styra & Oren Shomron, VMware. Introduces Open Policy Agent and how it enforces policy across cloud native systems.
concept · Secrets Store CSI Driver: Keeping Secrets Secret - Anish Ramasekar, Microsoft & Tommy Murphy, Google
concept · Enhancing Kubernetes with the Security Profiles Operator - Colleen Murphy & Sascha Grunert, Red Hat
concept · Making Dynamic Admission Control Even More Dynamic Using... Flavio Castelli & Rafael Fernández López
concept · Compliance the Easy Way: Zero-conf mTLS for Dev and smooth Day-2 f... Christian Hüning & Lutz Behnke
concept · CSI Volume Attacks – The SRE Strikes Back - Hendrik Land, NetApp. Examines attacks via CSI volumes and how SREs can defend against them.
concept · Get In Containerds, We’re Going Securing: Kubern... I. Coldwater, T. Sable, S. Raghunathan, A. Small. A talk on securing Kubernetes container runtimes with containerd and the security practices around it.
concept · Isolate the Users! Supporting User Namespaces in K8s for Increased Security - Mauricio Vásquez
concept · I Can RBAC, and So Can You! - Marc Boorshtein, Tremolo Security, Inc.
concept · Sponsored Lightning Talk: Security In Plain Sight: Hardening Systems Via Open Source- Phillip Gibson
tutorial · Hacking into Kubernetes Security for Beginners - Ellen Körbes, Tilt & Tabitha Sable, Datadog
tutorial · An Introduction to Cloud Native Security - Ash Narkar, Styra; Aradhna Chetal, TIAA & Andres Vega
keynote · Sponsored Session: Datadog - Policy-as-code for Kubernetes with Gatekeeper. Datadog sponsored session on policy-as-code for Kubernetes using Gatekeeper.
keynote · Sponsored Session: Bridgecrew - End-to-end policy-as-code from IaC to Running Workloads. A sponsored session pitching Bridgecrew's end-to-end policy-as-code from IaC to running workloads.

2021 · KubeCon + CloudNativeCon North America 2021 ¶

case study · Sigstore: How We Started, Where We Are, Where We are Headed - Bob Callaway & Dan Lorenc
concept · The Hitchhikers Guide to Container Security - Tunde Olu-Isa, Oteemo & Jed Salazar, Isovalent
concept · Fine-Grained User Authorization for Kubernetes with OPA and LDAP - Cagri Cetin & Quentin Long
concept · Know Your Enemy: Mapping Security Risks Using Threat Matrix for Kuber... Yossi Weizman & Ram Pliskin
concept · Back to the Drawing Board: Building Containers with SBoMs - Nisha Kumar, VMware. Discusses rethinking container builds so that SBOMs are produced as part of the build.
concept · Production Workload Identity with SPIRE - Ryan Turner, Uber
concept · Policy Matters! The Why, What, and How of Kubernetes Policy Management. Explains why and how to manage policy in Kubernetes.
concept · Notary: State of the Container Supply Chain - Justin Cormack, Docker & Steve Lasker, Microsoft
concept · Untangling the Multi-Cloud Identity and Access Problem With SPIFFE Tornjak - B Lum & M Sabath
concept · Keeping Up with the CVEs: How to Find a Needle in a Haystack? - Pushkar Joglekar, VMware. Describes how to find the vulnerabilities that matter among the many CVEs reported for Kubernetes.
concept · Kubernetes Supply Chain Security: The Software Factory - Andrew Martin, Control Plane. Andrew Martin presents a software factory model for securing the Kubernetes supply chain.
concept · Kubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You... Ian Coldwater & Brad Geesaman
concept · Creating Cloud Native Security - Emily Fox, Apple; Brandon Lum, IBM; Andres Vega, VMware
concept · Security Through Transparency: Kubernetes SIG Security Update
concept · Shh, It’s a Secret: Managing Your Secrets in a GitOps Way - Jake Wernette & Josh Kayani, IBM. IBM engineers show approaches for managing secrets in a GitOps workflow.
concept · gRPC Proxyless Service Mesh with Security - Sanjay M Pujare, Google
concept · SPIFFE: In Theory and in Practice - Evan Gilman & Andrew Harding, VMware
concept · Bridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication - Andrew Harding, VMware
concept · We Built the Kubernetes SBOM and Now You Can Write Your Own! - Adolfo García Veytia, uServers
concept · Beyond Kubernetes Security - Ellen Körbes, Tilt & Tabitha Sable, Datadog. Explores security threats that go beyond Kubernetes itself, starting from threat morphology.
tutorial · Introduction to Open Policy Agent - Ash Narkar, Styra & Rita Zhang, Microsoft
tutorial · My Container Image has 500 Vulnerabilities, Now What? - Matt Jarvis, Snyk. Practical guidance on triaging and fixing hundreds of vulnerabilities found in a container image.

2022 · KubeCon + CloudNativeCon Europe 2022 ¶

case study · Threat Hunting at Scale: Auditing Thousands of Clusters With Falco + F... Furkan Türkal & Emin Aktaş
case study · Fun with Continuous Compliance - Ann Wallace, Shopify & Zeal Somani, Google — Shopify. Shopify, with Google, shares how it approaches continuous compliance for its Kubernetes infrastructure.
case study · Real World SPIFFE Scenarios and Outcomes - Andres Vega & Frederick Kautz, SPIFFE Steering Committee — SPIFFE Steering Committee
concept · What If... Kube-Apiserver Could be Extended Via WebAssembly? - Flavio Castelli, SUSE. Explores extending the Kubernetes API server with WebAssembly modules.
concept · Securing Your Container Native Supply Chain with SLSA, Github and Te... Laurent Simon & Priya Wadhwa
concept · Harbor - Enterprise Cloud Native Artifact Regi... Yan Wang, Chenyu Zhang, Daojun Zhang & Vadim Bauer. Harbor maintainers present project features and updates for the cloud native artifact registry.
concept · CRI-O: Secure, Performant, and Boring... Peter Hunt, Urvashi Mohnani, Mrunal Patel & Sascha Grunert. Overview of CRI-O and its focus on being secure, performant and boring.
concept · Bypassing Falco: How to Compromise a Cluster without Tripping the SOC - Shay Berkovich, BlackBerry. Demonstrates techniques for compromising a Kubernetes cluster while evading Falco detection.
concept · Open Policy Agent (OPA) Intro & Deep Dive - Anders Eknert, Styra & Will Beason, Google
concept · Notary v2: Deep Dive and Open Issues - Justin Cormack, Docker & Steve Lasker, Microsoft. Deep dive into Notary v2 design and the open issues remaining.
concept · Komrade: an Open-Source Security Chaos Engineering (SCE) Tool for... Aaron Rinehart & Matas Kulkovas. Introduces Komrade, an open-source security chaos engineering tool.
concept · A Treasure Map of Hacking (and Defending) Kubernetes - Andrew Martin, ControlPlane. Maps the attack surface of Kubernetes and how attackers and defenders approach it.
concept · Lightning Talk: Secure Multi User HPC Jobs in Kubernetes with Kyverno - Trey Dockendorf
concept · PolicyReport CRD: Manage Admission Control, Runtime, and Scan Reports!
concept · SPIRE: Intro & Deep Dive Into Windows Support - Agustín Martínez Fayó & Marcos Yacob
concept · Staring Into the Abyss with the Security Technical Advisory Group - Andres Vega & Brandon Lum
concept · SIG Security Update: We Lift Tog... Tabitha Sable, Pushkar Joglekar, Rey Lejano, Savitha Raghunathan
concept · Three Surprising K8s Networking “Features” and How to Defend Against Them - James Cleverley-Prance. Covers three surprising Kubernetes networking behaviors and how to defend against them.
concept · Multi-Cloud Workload Identity With SPIFFE - Jake Sanders & Charlie Egan, Jetstack
concept · Too Much to Choose – Making Sense of a Smorgasbord of Security Standard- Anais Urlichs & Rory McCune
concept · Make the Secure Kubernetes Supply Chain Work for You - Adolfo García Veytia, Chainguard
concept · Flux Security Deep Dive - Stefan Prodan, Weaveworks
concept · Falco to Pluginfinity and Beyond - Leonardo Grasso & Jason Dellaluce, Sysdig
concept · How Attackers Use Exposed Prometheus Server to Exploit... David de Torres Huerta & Miguel Hernández. Demonstrates how attackers exploit exposed Prometheus servers to compromise Kubernetes environments.
concept · The Hitchhiker's Guide to Pod Security - Lachlan Evenson, Microsoft
concept · Distributing Supply Chain Artifacts with OCI & ORAS Artifacts - Steve Lasker, Microsoft

2022 · KubeCon + CloudNativeCon North America 2022 ¶

case study · What We Learned From the Gateway API: Designing Linkerd’s New Policy CRD - Matei David, Buoyant, Inc — Buoyant, Inc
case study · How the Argo Project Transitioned From Security Aware To Security First - Henrik & Michael Crenshaw
case study · From Security Testing To Deployment In a Single PR - Sarah Khalife, GitHub & Grant Griffiths — GitHub
concept · Kyverno Introduction And Overview - Chip Zoller & Dolis Sharma, Nirmata
concept · TUF-En Up Your Signatures - Marina Moore & Justin Cappos, NYU. Explains how TUF can be used to strengthen signature and software update security.
concept · OPA - Peter O'Neill, Styra
concept · Zero Trust Supply Chains with Project Sigstore and SPIFFE - Andres Vega & Jake Sanders
concept · Using the EBPF Superpowers To Generate Kubernetes Security... Mauricio Vásquez Bernal & Alban Crequy. Shows how eBPF tooling can observe workloads to automatically generate Kubernetes security policies.
concept · Cloud Governance With Infrastructure As Code (IaC) With Kyverno And Crossplane - Dolis Sharma
concept · SBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs - Brandon Lum& Chris Phillips
concept · Securing Edge Workloads With Cert-Manager And SPIFFE - Sitaram IYER & Riaz Mohamed, Jetstack Ltd
concept · Securing the IaC Supply Chain - Jesse Sanford, Autodesk & Jason Hall, Chainguard
concept · Don't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE - Evan Gilman
concept · SLSA FRSCA Recipe For Secure Supply Chain - Parth Patel & Michael Lieberman, Kusari
concept · So, SBOMs Matter…Now What? - Sophie Wigmore & Frankie Gallina-Jones, VMware. Explores what to do with SBOMs once you have them.
concept · Path To Production: Sustainable Compliance In Strict Environments - Chip Zoller & Brandt Keller. Explains how to achieve sustainable compliance when moving workloads to production in strict, regulated environments.
concept · Untrusted Execution: Attacking the Cloud Native Supply Chain - Andrew Martin, ControlPlane
concept · A New Way To Roll: Supply Chain Choreography For Enterprise Grade... - Kirti Apte & Steve Watkins
concept · Security In the Cloud With Falco: Overview And Project Updates - Jason Dellaluce & Luca Guerra
concept · Achieving End-To-End Software Supply Chain S... Santiago Torres-Arias & Aditya Sirish A Yelgundhalli
concept · Hack Back; Let’s Learn Security With CTFs! - Lewis Denham-Parry, Chainguard & Natalia Reka Ivanko
concept · Armoring Cloud Native Workloads With LSM Superpowers - Barun Acharya, Accuknox. Explains using Linux Security Modules to harden cloud native workloads.
concept · Trust But Verify: Bringing Supply Chain Integrity To CD GitOps - Yuji Watanabe & Hirokuni Kitahara
concept · Kubernetes Policy, Governance...- Jim Bugwadia, Anca Sailer, Jayashree Ramanathan, Robert Ficcaglia
concept · Staring Into the Abyss With the Security Technical... Andrew Martin, Ragashree Shekar, Marina Moore
concept · What Data Tells Us About Software Supply Chain... Josh Bressers, Tracy Miranda, John Yeoh, Eric Tice
concept · 9-1-1: Cloud Native - Kubernetes For Public Safety Systems - Marc Boorshtein, Tremolo Security, Inc.
concept · SIG Security: Empowerment Through Autonomy - Ala Dewberry, Savitha Raghunathan, Tabitha Sable. SIG Security describes how it operates with autonomy and empowers contributors.
tutorial · Tutorial: Reducing the Sticker Price Of Kubernetes Security - Pushkar Joglekar, VMware

2023 · KubeCon + CloudNativeCon + Open Source Summit China 2023 ¶

2023 · KubeCon + CloudNativeCon Europe 2023 ¶

case study · InSPIREing Progress: How We're Growing SPIFFE & SPIRE in 2023 & Beyond- Daniel Feldman & Andrés Vega
case study · Paved Paths Leading the Way to Compliance - Kasper Borg Nissen & Brian Nielsen, Lunar — Lunar. Lunar describes how paved paths helped it achieve compliance.
concept · Using OpenTelemetry for Application Security, with a Real Life Example - Ron Vider, Oxeye
concept · Anatomy of a Cloud Security Breach - 7 Deadly Sins - Maya Levine, Sysdig
concept · How SIG Release Makes Kubernetes Releases Even More Stable & Secure- Veronica Lopez & Marko Mudrinić. Describes how SIG Release improves the stability and security of Kubernetes releases.
concept · Cert-Manager Can Do SPIFFE? Solving Multi-Cloud Workload... - Thomas Meadows & Joshua Leeuwen
concept · A Confidential Story of Well-Kept Secrets - Lukonde Mwila, AWS. Covers approaches to keeping secrets confidential in Kubernetes workloads.
concept · 🦝 RBAC to the Future: Untangling Authorization in Kubernetes - Jimmy Mesta, KSOC. Explains how Kubernetes RBAC authorization works and how to untangle it.
concept · Policy Matters! A Policy Working Group Introduction and Deep Dive - Jim Bugwadia & Frank Jogeleit
concept · Nurturing Security Permaculture: Kubernetes SIG Security Update
concept · No Fear, Falco Is Looking After Us! - Jason & Luca, Melissa, Carlos, Hendrik
concept · Silly Gooses, Let's Make Sense of the Security Supply Chain, Together - Grace Nguyen
concept · Protecting Your Crown Jewels with External Secrets Operator - Moritz Johner, Form3
concept · Let’s Go Backstage: IDP Security for Platform Engineers - Rotem Refael & Suzanne Daniels
concept · Fight Back Against Cyber Risk in the Software Supply Chain with a Secure and...- Krishna & Brendan
concept · Verifiable GitHub Actions with eBPF - Jose Donizetti, Aqua. Shows how to verify GitHub Actions runs using eBPF.
concept · Improve Vulnerability Management with OCI Artifacts -It Is That Easy! - Itay Shakury & T Mladenov
concept · Mind the Gap! Bringing Together Cloud Services and Managed K8s Environments- Tafani-Dereeper & Comas. Explores security gaps between cloud provider services and managed Kubernetes environments.
concept · Checking the Chains at the Gate: Building Supply Chain Policies with Gatekeeper & Ratify - J Rickard
concept · Running Not Root Made Easy - Luboslav Pivarc, Red Hat. Explains how KubeVirt was changed to run without root privileges.
concept · Kubernetes Security Response Committee: Intro & Deep Dive - Monis Khan, Microsoft & Micah Hausler
concept · Kyverno Introduction and Deep Dive - Charles-Edouard Brétéché, Nirmata & Jinhong Brejnholt
concept · Security Controls for Safe Chaos Experimentation - Raj Babu Das & Umasankar Mukkara, Harness
concept · Back to the Future: Next-Generation Cloud Native Security - Matt Jarvis, Snyk & Andrew Martin
concept · 🦝 Interactive Playground to Learn Kubernetes and Cloud Native Security - Madhu Akula
concept · Life of a CVE with Ingress-Nginx; Understanding the Project's Release Cycle - J Strong & D Turnbull. Walks through the lifecycle of a CVE in ingress-nginx and how the project's release process handles it.
concept · In-Toto: Attestations and More for Software Supply Chain Security - Aditya Sirish A Yelgundhalli
concept · Staring Into the Abyss with the Security Technical Advisory Group - Michael Lieberman & Marina Moore
concept · Container Is the New VM: The Paradigm Change No One Explained...- Marga Manterola & Rodrigo Catelin. Explains how thinking of containers as lightweight VMs misleads, and what actually changes in the container model.
concept · Automating Configuration and Permissions Testing for GitOps with OPA...- Eve Ben Ezra & Michael Hume
concept · Secure Your Project with the SIG Release Supply Chain Kit - Adolfo García Veytia & Carlos Panato
concept · The Compliance Business Case for Kubernetes in the EU: Get Ready..- Robert Ficcaglia & Anders Eknert
concept · Securing the Container Supply Chain with Notary - Justin Cormack, Docker & Toddy Mladenov, Microsoft
concept · Open Policy Agent. (OPA) Intro & Deep Dive - Charlie Egan, Styra, Inc.. Intro and deep dive on Open Policy Agent and the Rego policy language.
concept · What Can Go Wrong When You Trust Nobody? Threat Modeling Zero Trust - J Callaghan & R Featherstone
concept · 🦝 The Top 10 List of Istio Security Risks and Mitigation Strategies - José Carlos Chávez, Tetrate
concept · Malicious Compliance: Reflections on Trusting Container... - Coldwater, Cooley, Geesaman, McCune. Reflects on the limits of trusting container images and the tooling used to verify them.
concept · Practical Challenges with Pod Security Admission - V Körbes & Christian Schlotter, VMware
concept · A Look Under the Hood of CNCF Security Audits - Adam Korczynski & David Korczynski, Ada Logics
concept · Hardening Kubeflow Security for Enterprise Environments - Julius Kohout & Diana Dimitrova Atanasova
concept · Maintaining TUF, a Talk - Joshua Lock, Verizon & Lukas Pühringer, NYU Tandon School of Engineering. Maintainers of The Update Framework (TUF) discuss the project's design, maintenance and ecosystem status.
tutorial · Tutorial: Getting Familiar with Security Observability Using eBPF &Cilium Tetragon - Holmes & Cooley
keynote · 🦝 Welcome to the Security Village - Marina Moore, NYU

2023 · KubeCon + CloudNativeCon NA 2023 ¶

case study · Deploying Kubernetes in Classified Environments - Vlad Ungureanu & Ali Monfre, Palantir Technologies — Palantir. Palantir shares how it deploys and operates Kubernetes in classified environments.
case study · Open and Secure: Lessons Learned in Five Years of TAG Security Assess... Justin Cappos & Andres Vega
case study · Software Delivery in Regulated Environments: Critical Infrastructure... Austen Bryan & Steven Ollek. Speakers share experience delivering software in regulated, critical-infrastructure environments.
case study · SECURITY HUB: From Threats to Trust: Safeguarding Sensitive Data in K8s - Moritz Eckert
case study · SECURITY HUB UNCONFERENCE: Seccomp policy usage: why there is no adoption?
concept · Network Policy API: Intro and Project... Andrew Stoycos, Surya Seetharaman, Dan Winship & Yang Ding
concept · When Is a Secure Connection Not Encrypted? and Other Stories - Liz Rice, Isovalent. Liz Rice explains when secure connections are not actually encrypted and the pitfalls of how encryption is applied in Kubernetes networking.
concept · All Things in-Toto: Supply Chain Attestations, Policies an... Santiago Torres-Arias & Marcela Melara
concept · Avoid an Ill Wind and Catch the Jet Stream – Using Falco to Detect Attackers & Compliance Violations
concept · Improving Kubernetes Security with the Konnectivity Proxy - Michael McCune & Joseph Anttila Hall
concept · Policy-Based Kubernetes Governance, Risk, and Compliance
concept · SIG Security: Unravelling the Kubernetes Security Audit Together
concept · All Cloud-Native Services Are Vulnerable — Block Exploits with Security... David Hadas & Roland Huß. Argues that cloud-native services are all vulnerable and shows how to block exploits using security guardrails.
concept · Security Showdown: The Overconfident Operator Vs the Nefarious N... Whitney Lee & Lewis Denham-Parry
concept · Kyverno: Overview and What's New - Chip Zoller, Nirmata & Zach Swanson, Wayfair
concept · Improving the Security of Software Supply Chains with Notary Project- Toddy Mladenov & Milind Gokarn
concept · Flux 2.0 and Beyond: Amplifying GitOps with OCI and Cosign - Kingdon Barrett & Sanskar Jaiswal
concept · Survive eBPF Deployment with Bpfd - Andrew Stoycos, Red Hat & Shane Utt, Kong. Presents bpfd for safely deploying and managing eBPF programs in Kubernetes.
concept · Secure Transport for Your Software Supply Chain with TUF - Marina Moore & Trishank Kuppusamy
concept · Forget Everything You Know About Image Vulnerability and Prioritization - Ben Hirschberg, ARMO
concept · Identity-Based Segmentation: An Emerging Standard for Zero Trust from NIST - Zack Butcher, Tetrate
concept · Paint the Picture! - Detecting Suspicious Data Patterns in E... Natalia Reka Ivanko & John Fastabend. Shows how Tetragon uses eBPF and kTLS to detect suspicious data patterns in encrypted traffic.
concept · Streamlining FedRAMP Compliance with CNCF Technologies - Ali Monfre & Vlad Ungureanu
concept · Secrets of Running Etcd - Marek Siarkowicz, Google
concept · Supercharge Your Software Supply Chain Security Strategy with Multi-SBOM Integ... Pallavi Kalapatapu. Explains how integrating multiple SBOMs can strengthen a software supply chain security strategy.
concept · The Future of Kubernetes Auth and Policy Config: Common Expression Langu... Mo Khan & Jordan Liggitt
concept · Open Policy Agent (OPA) Intro & Deep Dive - Charlie Egan, Styra & Sertaç Özercan, Microsoft
concept · Leveraging SPIRE for All Your Production Identity Needs - Ryan Turner & Chirag Kapadia
concept · Automate Production-Ready Cluster Using Crossplane Compositions and Kyverno - Dolis Sharma, Nirmata
concept · RBACdoors: How Cryptominers Are Exploiting RBAC Misconfigs - Greg Castle & Vinayak Goyal, Google
concept · Safeguarding Clusters: Exploring the Benefits and Navigating... - Amine Hilaly & Igor Velichkovich. Explores benefits and challenges of safeguarding Kubernetes clusters.
concept · Lightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) Policies - Omri Gazitt
concept · A Wind of Change for Threat Detection - Melissa Kilby, Apple. Describes changes and new directions in threat detection, focused on Falco and runtime security.
concept · SECURITY HUB UNCONFERENCE: STRIDE threat model for the vSphere CSI Driver. Unconference session applying the STRIDE threat model to the vSphere CSI driver.
concept · SECURITY HUB: Making Kubernetes Quantum-Safe: What Can We Do... Paul Schweigert & Michael Maximilien
concept · SECURITY HUB: Fuzzing Introduction + OSS-Fuzz Demo - Adam & David Korczynski, Ada Logics
concept · SECURITY HUB UNCONFERENCE: The Active Observer of a Zero Trust Architecture
concept · SECURITY HUB UNCONFERENCE: gittuf, A Security Layer for Git Repositories
concept · SECURITY HUB UNCONFERENCE: TAG Security Supply Chain WG
tutorial · Wolfi: Intro to the Linux Undistro Helping Build Small, up-to-Date, CVE Free... - James Rawlings
tutorial · SECURITY HUB: Hacking the Kubernetes Secure Software Supply-chain wi... John McBride & Sean McGinnis. Hands-on session on attacking and defending the Kubernetes software supply chain.
keynote · Grifts Ahoy! Bracing for the AI Tide - Shane Lawrence, Shopify. Shopify's Shane Lawrence offers a cautionary perspective on preparing for the AI wave.

2024 · KubeCon + CloudNativeCon + Open Source Summit + AI_dev China 2024 ¶

case study · Ensuring Success with Kyverno in Production: What You Must Know - Shuting Zhao
case study · Strengthening Container Security: A Collaborative Journey - Yi Zha & Beltran Rueda Borrego
concept · Enhancing Security and Software Supply Chain: Recent and Upcoming Features in Harbor - Stone Zhang
concept · Enforceable Supply Chain Security Policy with OPA Gatekeeper and Ratify - Feynman Zhou & Dahu Kuang
concept · Security Threat Model Analysis and Protection Practice in Edge Computing... - Yue Bao & Huan Wei
concept · Choose Your Own Adventure: The Struggle for Security | 选择你的冒险：安全之战 - Whitney Lee & Viktor Farcic
concept · Unified Management, Continuity, Compliance in Multi-Clouds with Service Mesh - Kebe Liu, DaoCloud
concept · Safeguarding Cloud Native Supply Chain - Yi Zha & Mostafa Radwan. Covers approaches to safeguarding the cloud native software supply chain.
concept · Scorecard: Assessments Made Easy | Scorecard：让开源项目评估更轻松 - Ram Iyengar, Cloud Foundry Foundation. Introduces OpenSSF Scorecard for easily assessing the security posture of open source projects.
concept · Enhancing Cyber Resilience Through Zero Trust Chaos Experiments in... - Sayan Mondal & Rafik Harabi
concept · Project Lightning Talk: Kyverno Kickoff: Getting Your Team Onboard in a Flash
concept · Project Lightning Talk: Explore Secure Artifacts Storage and Management with Harbor. Lightning talk on secure artifact storage and management with the Harbor registry.
tutorial · Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to... Enguerrand Allamel. A practical guide to achieving SLSA compliance across the software build and delivery pipeline.

2024 · KubeCon + CloudNativeCon Europe 2024 ¶

case study · Search at Shopify: Highly Available Platform for Data Resilience and Compliance - Leila Vayghan — Shopify
case study · Lessons Learned from Generating 100M SBOMs: Google’s Approach to SBOM Compliance
case study · From Chaos to Control: Cloud Native Governance with Kyverno! — DE-CIX. DE-CIX describes using Kyverno policies to govern its Kubernetes environment, plus recent additions and the project roadmap.
case study · No 'Soup' for You! Enforcing Network Policies for Host Processes via eBPF - Vinay Kulkarni, eBay — eBay. eBay describes enforcing network policies on host processes with eBPF in its own infrastructure.
case study · Securing the Supply Chain with Sigstore Artifacts Signatures at Scale
concept · Open Policy Agent (OPA) Intro & Deep Dive - Anders Eknert, Styra & Xander Grzywinski, Microsoft
concept · Kubernetes Security Blind Spot: Misconfigured System Pods - Shaul Ben Hai, Palo Alto Networks. Shows security risks from misconfigured system pods in Kubernetes.
concept · Keeping Kubernetes Safe: The Lowdown on Locked Namespaces - Marco De Benedictis, ControlPlane. Explains how to lock down Kubernetes namespaces to isolate tenants and keep clusters safe.
concept · Leveraging OCI 1.1 for Enhanced SBOM Integration and Vulnerability Scanning in Harbor. Shows how Harbor uses OCI 1.1 to integrate SBOMs and vulnerability scanning.
concept · It's Not Just About SBOMs: Perspectives on Cloud Native Supply Chain Security
concept · SIG Security Update: Growing Together. Update on Kubernetes SIG Security's work and community growth.
concept · Next-Level Security: Implementing MTLS in Istio Multi-Cluster Environments Using SPIRE. Explains implementing mTLS across Istio multi-cluster environments using SPIRE for identity.
concept · Cilium ClusterMesh in Action: Strengthening Security Across Distributed Kubernetes Clusters
concept · Bringing SPIFFE to Linkerd for Mesh Expansion - Zahari Dichev, Buoyant
concept · Kubernetes Policy Time Machine: Where to Next? - Jim Bugwadia, Nirmata & Andy Suderman, Fairwinds
concept · Memory Armor for SPIRE: Fortifying SPIRE with Confidential Containers (CoCo)
concept · Cloud Native Security: Cell-Based Architecture & K8s - Rostyslav Myronenko & Shweta Vohra
concept · Fortifying AI Security in Kubernetes with Confidential Containers (CoCo)
concept · Navigating the Software Supply Chain Defense Landscape - Marina Moore & Aditya Sirish A Yelgundhalli
concept · Network Policy: The Future of Network Policy with AdminNetworkPolicy
concept · Feature Management Improv: Reduce Risk, Conquer Compliance, and Perfect Previews with OpenFeature
concept · OAuth2 Token Exchange for Microservice API Security - Ahmet Soormally & Letz Yaara, Tyk. Explains using OAuth2 token exchange to secure APIs between microservices.
concept · Is Your Image Really Distroless? - Laurent Goderre, Docker. Examines what makes a container image truly distroless and how to verify it.
concept · Playing Defense: The Reactive Cloud Native Security Battle - Ayse Kaya, Slim.AI
concept · Enabling the Software Supply Chain Ecosystem with Notary Project. Describes how the Notary Project enables signing and verification across the software supply chain ecosystem.
concept · Policy as Code: A Game-Changer for Stack Security - Raz Cohen, Permit.io. Argues policy as code improves security across the stack.
concept · Linkerd Project Update: VM Support, Ingress, Security on the Edge, and Rust
concept · Dapr in 2024: Deployments Beyond Sidecars, Distributed Scheduler API and App-Level Zero Trust
concept · TAG Security Highlights - Marina Moore, New York University; Michael Lieberman
concept · Choose Your Own Adventure: The Struggle for Security - Whitney Lee, VMware & Viktor Farcic, Upbound
concept · An Acronym Free Introduction to Software Supply Chain Security - Joshua Lock, Verizon. Gives an introduction to software supply chain security without jargon.
concept · How Many Network Policies Can I Create? - Nadia Pinaeva, Red Hat & Shaun Crampton, Tigera. Examines how many network policies a cluster can handle and how different CNIs scale.
concept · Kyverno Top 10: Automate Kubernetes Security With Policy as Code | Project Lightning Talk
concept · Achieving Balance Between Security and Performance in Falco | Project Lightning Talk
concept · Want to secure K8s clusters? Think Paralus. | Project Lightning Talk. Project lightning talk introducing Paralus for securing Kubernetes cluster access.
concept · Falco: A Grand Promenade Through Cloud Native Runtime Security - Panel
concept · Enforceable Software Supply Chain Policies and Attestations... Alan Chung Ma & Santiago Torres-Arias

2024 · KubeCon + CloudNativeCon India 2024 ¶

concept · Dynamic Management of X509 Certificates Using Kubernetes Certificate Ope... A. Joshi & S. Ponnuswamy. Shows how to manage X509 certificates dynamically with a Kubernetes certificate operator.
concept · Policy-Driven Cost Optimization in Kubernetes with Kyverno | Project Lightning Talk
concept · LitmusChaos Evolution: The Latest Innovations and Security Enhancements To Chaos Engineering
concept · Kyverno: An Introduction and Deep Dive - Panel
concept · SPIFFE as a Glue for Large Scale Telco Deployments: A Nephio Perspective - Rahul Jadhav, AccuKnox
concept · Fuzzing for Stability: Uncovering and Mitigating Helm's CVE - Jakub Ciolek, AlphaSense
concept · Enhance Kubernetes Security with the Common Expression Language (CEL) - Hoon Jo, Megazone. Shows how CEL can be used to strengthen Kubernetes security policies.
concept · A Deep Dive Into the Current Runtime Security Landscape - Ankur Kothiwal, CERN. Survey of the current runtime security tooling landscape for cloud native workloads.
concept · Cilium: Connecting, Observing, and Securing Kubernetes and Beyond with eBPF - B. Mulligan & N. Bisht. Overview of Cilium for connecting, observing and securing Kubernetes with eBPF.

2024 · KubeCon + CloudNativeCon NA 2024 - Salt Lake City ¶

case study · Multi-Tier Security in WasmCloud: From Developer Constraints to Platform Extensibility - B. Townsend
concept · Peak Innovation and Cloud Tweaks: Falco’s Ongoing Runtime Security Development - Panel
concept · SPIRE: Intro & In-Depth Exploration of the Upcoming Forced Rotation and Revoc... A.M. Fayó, M. Yacob
concept · Artifact Hub: Discover, Analyze, and Share Cloud Native Artifacts - Matt Farina, SUSE. Introduces Artifact Hub for discovering, analyzing and sharing cloud native artifacts.
concept · Elevate Your Kubernetes Policy Game with Kyverno! - C. Breteche, L. Chiang, K. Tu
concept · Secure Release Processes with in-Toto Policy Verification - John Kjell, Aditya Sirish A Yelgundhalli. Shows how in-toto policy verification can secure software release processes.
concept · Best Friends Keep No Secrets: Going Secretless with cert-manager - Ashley Davis & Tim Ramlot, Venafi
concept · CEL-Ebrating Simplicity: Mastering Kubernetes Policy Enforcement - Kevin Conner & Anish Ramasekar. Shows how CEL expressions simplify Kubernetes policy enforcement through built-in admission policies.
concept · Breaking Free from Vulnerability Scanning Noise: Automated VEX Aggregation for Accuracy - T. Fukuda. Presents a centralized VEX repository and automated aggregation to cut vulnerability scanning noise.
concept · Running Quantum-Safe Applications on Kubernetes - Paul Schweigert & Michael Maximilien, IBM Quantum. Shows how to run quantum-safe applications on Kubernetes.
concept · SPIFFE the Easy Way: Universal X509 and JWT Identities Using cert-manager - Tim Ramlot, Ashley Davis
concept · Practical Supply Chain Security: Implementing SLSA Compliance from Build to Runtime - E. Allamel. Shows how to implement SLSA compliance across the software supply chain from build to runtime.
concept · SPIFFE Deployments in Non-Kubernetes Environments - Nadin El-Yabroudi & Eli Nesterov, SPIRL
concept · Why Perfect Compliance Is the Enemy of Good Kubernetes Security - Michele Chubirka, Google
concept · Working Together to Improve Security Visibility in Kubernetes - Rita Zhang & Jeremy Rickard
concept · Pushing Authorization Further: CEL, Selectors and Maybe RBAC++ - Mo Khan, Rita Zhang, Jordan Liggitt
concept · Open Policy Agent (OPA) Intro, Deep Dive & V1.0 Update - Charlie Egan, Styra & Rita Zhang, Microsoft
concept · Harbor: Harbor and the World of SBOMs | Project Lightning Talk. Project lightning talk on how Harbor handles SBOMs.
concept · Kyverno: Level Up Your Cluster - 5 Kyverno Policies You Need Now! | Project Lightning Talk
concept · Open Policy Agent (OPA): That's One Small Bump for OPA, but One Giant Leap for Policy as Code | PLT. Open Policy Agent project update and policy-as-code progress.
concept · Falco: Evolution of Real Time Cloud Security with Falco | Project Lightning Talk
concept · SIG Auth & SIG Storage: Secret Guardians - (Secrets Store) CSI Driver and Sync Controller | PLT
concept · What Agent to Trust with Your K8s: Falco, Tetragon or KubeArmor? - Henrik Rexed, Dynatrace
tutorial · TLS and MTLS: Introduction to Modern Security - Andrew Davis & Sandeep Kanabar
panel · AI for Policy and Policy for AI! - P. Lamba, B. Kurktchiev, A. Suderman, R. Petty, J. Ray. Panel on using AI for policy and policy for AI.
panel · The Policy Engines Showdown - G.L. Manor, A. Aguiar, O. Gazitt, P. Jamin, T. Schade, J. Scharmen. Panel comparing policy engines for Kubernetes.

2024 · SECURITY HUB @ KubeCon EU 2024 ¶

2025 · KubeCon + CloudNativeCon China 2025 (Hong Kong)¶

concept · Unlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters - Di Xu & Xu Liu
concept · Project Lightning Talk: Kyverno Lightning Update: CEL & Policy Types in Action - Shuting Zhao
concept · Simplifying the Networking and Security Stack With Cilium, Hubble, and Tet... Liyi Huang & Kaixi Fan
concept · Connecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and... Chen Yu & Jian Zhu
concept · Policy as Code: Past, Present and Future for Novice - Hoon Jo, Megazone. Introduces policy as code, its history, current tools and future direction for newcomers.

2025 · KubeCon + CloudNativeCon Europe 2025 - London ¶

case study · EVAPorating Kubernetes Security Risk: Adopting Validating Admission P... Kaitlyn Lee & Jordan Conard
case study · Zero Trust at Shopify Scale: Automating MTLS Across Thousands of Serv... Dani Santos & Michelle Mali — Shopify
concept · Notary Project: The Key To Secure Software Supply Chain - Yi Zha & Guillaume Gill. Introduces the Notary Project and how it signs and verifies artifacts to secure the software supply chain.
concept · Compliance at the Speed of Innovation: Leveraging AI-Driven Automation for Real-Time Regulatory Read
concept · Fresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public Dock... Guillaume Valadon. Presents findings and lessons from analyzing 180,000 public Docker images for leaked secrets.
concept · Stateful Connections in Kubernetes: The Scaling Secrets Nobody... André Mocke & Rodrigo Fior Kuntzer
concept · Unlocking the Future of Kubernetes Policy as Code With Kyverno - Vishal Choudhary & Frank Jogeleit
concept · Linkerd Update: Gateway API, Client-Specific Policy, Federated Services, Multicluster... Alex Leong
concept · SIG Security: Succession Pla ...Cailyn Edwards, Iain Smart, Rory McCune, Tabitha Sable & Mahé Tardy. SIG Security discusses succession planning and the future of the group.
concept · The Immediate and Lasting Benefits of TAG Security Assessments - Brandt Keller & Ben Hirschberg
concept · Open Source Malware or a Vulnerability?... Brian Fox, Madelein van der Hout & Santiago Torres-Arias
concept · Open Policy Agent (OPA) Intro & Deep Dive - Charlie Egan & Anders Eknert, Styra
concept · In the Eye of Falco: Tr... Luca Guerra, Jason Dellaluce, Aldo Lacuku, Leonardo Grasso, Aurélie Vache
concept · TUF-en up Your Software Supply Chain - Marina Moore, Edera & Kairo De Araujo, Independent
concept · Securing the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol... Huabing (Robin) Zhao
concept · Platform Engineering Loves Security: Shift Down To Your Platform... Maxime Coquerel & Mathieu Benoit
concept · Redefining Access Control: Scaling Policy as Code for Humans and AI Agents - Raz Cohen, Permit.io
concept · SPIFFE in Practice: Universal Identity for WebAssembly Workloads - Joonas Bergius & Colin Murphy
concept · Mind the Gap: Bridging Supply Chain Policy With Git-less GitOps... Michael Lieberman & Andrew Martin
concept · Identity-based Trust - Till Death Do We Part? - John Kjell & Kairo De Araujo. Examines the limits of identity-based trust in software supply chain security and what could replace or complement it.
concept · What's New in Knative Eventing: Security, Discovery, Int... Pierangelo Di Pilato & Christoph Stäbler. Presents new Knative Eventing features covering security, discovery and integrations.
concept · A Practical Guide To Kubernetes Policy as Code - Jim Bugwadia, Rita Zhang, Andy Suderman & Joe Betz
concept · Project Lightning Talk: Simplifying Cloud-Native Security: eBPF-Powered Encryption in... Muyang Tian
concept · Project Lightning Talk: external-secrets: Zero Trust Secrets Management with ESO - Moritz Johner. Lightning talk on zero trust secrets management with the External Secrets Operator.
concept · Project Lightning Talk: A Security Engineer’s Guide to TAG Security - Brandt Keller, Technical Lead
concept · Project Lightning Talk: ORAS: Create and Distribute a Multi-platform Image with Secu... Andrew Block. Lightning talk on using ORAS to create and distribute multi-platform images with security features.
concept · Beyond Security: Leveraging OPA for FinOps in Kubernetes - Sathish Kumar Venkatesan
tutorial · Tutorial: Hacking up a Storm With Kubernetes - Rory McCune, Datadog; Marion McCune & Iain Smart. Hands-on tutorial on attacking and hacking Kubernetes clusters.

2025 · KubeCon + CloudNativeCon India 2025 ¶

concept · Lightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks - Ramakant Sharma
concept · Project Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed! - Mohd Kamaal, Contributor
concept · Keep Calm and Carry on Cluster Updates - Thanks To Kyverno Chainsaw - Vijay Dharap, Kubermatic
concept · Guard Your Network With Kyverno and Envoy - Sanskar Gurdasani & Swastik Gour
concept · Choose Your Shield: Evaluating Linux Security Modules for Cloud Na... Ramakant Sharma & Rishabh Soni. Compares Linux security modules for securing cloud native workloads.
concept · Security: The Thing That Everyone... Bhavani Indukuri, Sonali Srivastava, Ram Iyengar & Anusha Hegde
concept · Kubernetes Policy as Code for Platform Engineers - Sonali Srivastava, Mohd Kamaal & Kushal Agrawal
concept · Fine-Grained Authorization: The Missing Piece in Agentic AI Security - Shivay Lamba & Ashish Jha

2025 · KubeCon + CloudNativeCon Japan 2025 (Tokyo)¶

2025 · KubeCon + CloudNativeCon North America 2025 ¶

case study · Patch Me If You Can: Tackling Outdated Addons Before They Become... Stevie Caldwell & Andy Suderman. Practitioners share how they handle outdated cluster addons before they turn into security and operational problems.
case study · From Bespoke To Bulletproof: SPIFFE/SPIRE With ESO for Enterprise Zero... May Large & Ivy Alkhaz
concept · Mission Abort: Intercepting Dangerous Deletes Before Helm Hits Apply - Payal Godhani, Oracle. Presents a way to intercept dangerous resource deletions before Helm applies a change.
concept · Open Policy Agent (OPA) Intro & Deep Dive - Philip Conrad, Tyler Schade, Rita Zhang & Jaydip Gabani
concept · The Hidden Risks in AI/ML Supply Chains: How To Secure Your Workloads - Yash Pimple, Chainguard. Discusses supply chain risks in AI/ML workloads and how to secure them.
concept · Aligning Enterprise AI Security With MITRE ATLAS Using Op... Doron Caspin & Valentina Rodriguez Sosa
concept · Lightning Talk: Threat Modeling Kubernetes: Fast, Practical, and LLM-Driven - Maxime Coquerel. Lightning talk on fast, practical, LLM-driven threat modeling for Kubernetes.
concept · Kubernetes Infra SIG: Intro and Updates - Mahamed Ali, Arab Center for Research & Policy Studies. Introduces Kubernetes SIG Infra and gives updates on its work.
concept · MUST/SHOULD/MAY - A Tour of TAG Security and Compliance Project... Evan Anderson & Brandt Keller
concept · Quantum-Resistant Kubernetes: Realities, Risks & (Versioning) Pitfalls - Fabian Kammel, ControlPlane. Explains the realities, risks and versioning pitfalls of making Kubernetes quantum-resistant.
concept · Beyond the Cloud(s): Falco’s Ascent in Performance and... Leonardo Grasso & Leonardo Di Giovanna. Falco project update on performance improvements and new capabilities.
concept · Security Theater or Real Defense? Navigating... Rotem R, Constanze R, Megan W, Stefana M & Oshrat N
concept · Kyverno Everywhere: Simplifying Unified Policy as Code - Jim Bugwadia & Charles-Edouard Brétéché
concept · Strengthening Supply Chain for Kubernetes: Cross-Cloud SLSA Attestation... Feynman Zhou & Dahu Kuang
concept · No Joke: Two Security Maintainers Walk Into a Cluster - Jackie Maertens & Nilekh Chaudhari
concept · End-to-End Security With gRPC in Kubernetes - Shiva & Abhishek Agrawal, Google
concept · Project Lightning Talk: Making Kubescape Storage Scale From Small and Mid-Size To... Ben Hirschberg. Lightning talk on making Kubescape storage scale from small to large clusters.
concept · Project Lightning Talk: Invisible FinOps and Compliance: Shift Left With Cloud Custodian - Sonny Shi
concept · Project Lightning Talk: When Falco Spots Trouble, The Shark Swims In - Gerald Combs
concept · Project Lightning Talk: The Kyverno Five: New Policy Types And What You Can Do... Cortney Nickerson. Overview of the new policy types in Kyverno and what users can do with them.
concept · Project Lightning Talk: Kubewarden: The Universal Policy Engine For Kubernetes
concept · Project Lightning Talk: The Same Great OPA, Only Faster! - Philip Conrad, Maintainer
concept · Butterfly Effect: What Kubernetes SIG Security Has in F... I. Coldwater, S. Raghunathan, C. Valencia
tutorial · Who Wants To Secure Clusters ? - Henrik Rexed & Simon Reisinger, Dynatrace. Walkthrough of securing Kubernetes clusters.
panel · In AI We Trust? Securing the Future, One Agent... Lin S, Yuval K, Hannah F, Andrew M & Ricardo A. Panel discussing how to secure AI agents and build trust in them.

2026 · KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026 ¶

concept · All-or-Nothing No More: Taming Kubernetes Impersonation With Granular Controls - Jian Qiu. Shows granular controls to replace all-or-nothing Kubernetes impersonation permissions.
concept · Pathless First: Redefining Runc Container Security Against ProcFS-Based Attacks - Fubang Li

2026 · KubeCon + CloudNativeCon Europe 2026 ¶

case study · Kubernetes Security at Shopify Scale: Automating Security Across an Infrastr... Jie Wu & Pulkit Garg — Shopify
case study · Is the Agent in the Room with Us Right Now? - Nick Rutigliano & Andrew Halaney, Netflix — Netflix. Netflix engineers share their own experience with AI agents operating in their environment and the challenges of knowing what agents are doing.
case study · When Multitenancy Goes Wrong: A Deep Dive Into Kcp’s First CVE - Marvin Beckers, ClickHouse — ClickHouse. ClickHouse's maintainer walks through kcp's first CVE, a multitenancy failure, and its lessons.
concept · Project Lightning Talk: Namespace Multi-Tenancy, But All The Problems Related To It - Hristo Hristov. A lightning talk on the problems with relying on namespaces alone for multi-tenancy.
concept · Project Lightning Talk: Blocking Vulnerable Workloads Out (And Catching What Got I... Alessio Greggi. Lightning talk on blocking vulnerable workloads from deploying and catching those that get through.
concept · Project Lightning Talk: A Maintainer’s Tour Of Tag Security And Compliance - Marina Moore
concept · Beyond Image Pull-Time: Ensuring Runtime Integrit... Toddy Mladenov, Flora Taagen & Dallas Delaney. Discusses ensuring container integrity at runtime, beyond verification at image pull time.
concept · Project Lightning Talk: Beyond Guardrails: Resource Lifecycle Automation With Kyverno - Ammar Yasser
concept · Project Lightning Talk: How To Add A New Language Feature To OPA - Charlie Egan, Maintainer
concept · Project Lightning Talk: Forensics With Falco - Gerald Combs, Maintainer
concept · Enforce VIP Access Only Through Node Attestation - Alice Frosi & Jakob Naucke, Red Hat. Shows how to restrict VIP access to workloads whose nodes have passed attestation.
concept · SPIFFE Meets OAuth: Federated Identity for Cloud Native Workloads - Yoshiyuki Tabata, Hitachi, Ltd.
concept · Evolving Policy Management with Agentic AI: Kyverno MCP and Kagent for... Shuting Zhao & Dahu Kuang
concept · Signed, Sealed, Delivered: Why Reverse Proxies Outperform VPNs - Peter O'Neill & Boris Kurktchiev. Argues that reverse proxies outperform VPNs for secure access and explains why.
concept · Advanced Kyverno Patterns : Automating Platform Security and Ope... Frank Jogeleit & Johannes Sonner. Advanced Kyverno patterns for automating platform security and operations.
concept · A Bug’s-Eye View: Kubernetes SIG Security Explains It... Ian C, Tabitha S, Rory M, Iain S & Mahé T
concept · Why Isn't the Fix in My Container? Tracking CVE Propagation Across... Mor Weinberger & Lior Kaplan. Explains how CVE fixes propagate through the image supply chain and why a fix may not appear in a container.
concept · Detect, Decide, Defend: Building Cloud Native Security That Fights Back - Matthias Bertschy, ARMO. Talk on building cloud native security that detects threats and responds automatically.
concept · Audit-Ready Kubernetes: How Chase UK Leveraged Policy as Code for Co... Jim Bugwadia & Nischay Goyal
concept · Automate Once, Run Anywhere: The Docker Moment for Security Workflows - Nancy Chauhan & Aseem Shrey
concept · Hack Me If You Can: Learning Kubernetes Security Through a Role-P... Aoi Takahashi & Keita Mochizuki
concept · Three Shades of Isolation: A Multi-tenancy Fortress - Braulio Dumba & Paolo Dettori, IBM. IBM presents three levels of isolation for building multi-tenant Kubernetes environments.
concept · Strengthening CNCF Projects: Impact of Security... Eddie K, Bradley A, Justin C, Shuting Z & Orlin V
concept · Right-sized Access Control & Pull with Proof - Stanislav Láznička & Lucas Käldström. Discusses right-sized access control and pulling container images with proof of provenance.
concept · Open Policy Agent. (OPA) Intro & Deep Dive - Charlie Egan & Anders Eknert, Apple
concept · Why Security of Kubernetes Comes Down to Linux Security - Marina Moore, Edera
concept · Securing the AI/ML Lifecycle With MLSecOps: Open Source Best... Bahaulddin Shammary & Andrey Shorov. Covers open source best practices for securing the AI/ML lifecycle with MLSecOps.
concept · In Falco's Nest: The Evolution of Cloud Native Runtime Security - Iacopo Rozzo & Aldo Lacuku
concept · Real-World Supply-Chain Security - Alex Leong, Buoyant. Covers practical supply-chain security measures and threats, from the Buoyant perspective.
concept · The Developer’s Nightmare: How To Survive Compliance Che... Alexandra Hou Aldershaab & Thomas Vitale
concept · WIT Happens: Exploring the Latest Evolution of the SPIFFE and... Noah Stride & Arndt Schwenkschuster
concept · Policy Engines for Kubernetes: Picking One Without Losing Your Mind - Nabarun Pal, Broadcom

2026 · KubeCon + CloudNativeCon India 2026 ¶

case study · Zero Trust for Fintech: Building Secure Banking Infrastructure Wit... Prasta Maha & Herbert Sianturi. Describes building secure zero-trust banking infrastructure for fintech on cloud native tooling.
concept · Zero Trust for Autonomous Agents: Isolating AI Workloads on Kubernetes - Kanagalingam Senthalan. Presents a zero trust approach to isolating autonomous AI agent workloads on Kubernetes.
concept · Project Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle - Neha Jaju
concept · Commit-Then-Disclose: Cryptographic SBOM Auditing Without IP Leakage - Sharvil Bhatt & Swastik Gour
concept · No More Secrets With Keycloak's Federated Client Authentication - Rishabh Singh, Red Hat

2026 · KubeCon + CloudNativeCon Japan 2026 ¶

case study · Runtime Security at Scale With EBPF: Hybrid Detection and Root Cause… Y. Krishna Kota & R. Waghare
case study · User Namespaces in Production: Enabling Root in Containers With RWX - Kohei Sugihara & Toru Komatsu — Preferred Networks. Describes running user namespaces in production to enable root inside containers with RWX storage.
concept · Scalable Security and Compliance in the Age of AI - Eddie Knight, Revanite
concept · Vulnerability Response for Large Open Source Projects - Jo Guerreiro & Charline Voinot, Grafana Labs