Security: case studies over time¶

52 case studies across 22 events, oldest first. Generated by wiki find "security"; each moment links to where the talk discusses it.

Organizations: Alibaba Cloud, Ant Financial, Buoyant, Inc, Capital One, ClickHouse, ControlPlane, DE-CIX, DoD, Elastisys, GitHub, Goldman, HP, Lunar, Nav, Netflix, Palantir, Preferred Networks, SPIFFE Steering Committee, Salesforce, Shopify, Spotify, Standard Chartered, Yelp, Zachary Arnold & Austin Adams' employer, eBay

2016 · KubeCon + CloudNativeCon North America 2016 (Seattle)¶

Evolving Dev and Ops with Kubernetes: Enterprise Adoption for Security, Speed, and Ease ¶

2018 · KubeCon + CloudNativeCon China 2018 (Shanghai)¶

Compliance as Code - Lessons Learned From Regulated Organizations - Sergiu Bodiu, Standard Chartered — Standard Chartered¶

2018 · KubeCon + CloudNativeCon Europe 2018 (Copenhagen)¶

Achieving High Security at Scale with Microservices - Zachary Arnold & Austin Adams — Zachary Arnold & Austin Adams' employer¶

Speakers describe how they achieved high security across a large microservices deployment in their own organization.

Case study: How Containers Makes Security and Compliance Instantly Easier - John Morello ¶

From Kubelet to Istio: Kubernetes Network Security Demystified - Andrew Martin, ControlPlane — ControlPlane¶

2018 · KubeCon + CloudNativeCon North America 2018 (Seattle)¶

How We Survived Our First PCI/HIPAA Compliant Check with Kubernetes - Travis Jeppson, Nav — Nav¶

Nav shares how it passed its first PCI/HIPAA compliance check while running on Kubernetes.

Shopify’s $25k Bug Report, and the Cluster Takeover That Didn’t... - Greg Castle & Shane Lawrence — Shopify¶

Shopify recounts a $25k bug report that could have led to a cluster takeover and how it was found and fixed.

Towards Trading on Kubernetes: Operating Multi-Tenant and Se... - Andrew Kochut & Javier Diaz-Montes ¶

Describes operating multi-tenant, secure Kubernetes for trading workloads.

2019 · KubeCon + CloudNativeCon China 2019 (Shanghai)¶

No More Chaos: Audit and Inspect Kubernetes at Scale - 陈杰, 阿里云 & 马金晶, 蚂蚁金服（杭州）网络技术有限公司 — Alibaba Cloud, Ant Financial¶

Alibaba Cloud and Ant Financial present how they audit and inspect Kubernetes clusters at scale.

Lightning Talk: How We Use Istio and OPA for Authorization - Lin Tao, HP — HP¶

2019 · KubeCon + CloudNativeCon Europe 2019 (Barcelona)¶

Uber x Security: Why and How We Built Our Workload Identity Platform - Tyler Julian & Daniel Feldman ¶

5 Simple Steps To Simplifying Your Compliance Journey With a Service Mesh – Granville Schmidt ¶

2019 · KubeCon + CloudNativeCon North America 2019 (San Diego)¶

How Yelp Moved Security From the App to the Mesh with Envoy and OPA - Daniel Popescu & Ben Plotnick — Yelp¶

Kubernetes Policy Enforcement Using OPA At Goldman Sachs - Miguel Uzcategui & Tim Hinrichs — Goldman¶

2020 · KubeCon + CloudNativeCon Europe 2020 - Virtual¶

Going Containerless with WebAssembly - Kevin Hoffman, Capital One — Capital One¶

Capital One describes its exploration of running workloads with WebAssembly instead of containers.

Operating Enterprise Grade Kubernetes Clusters at Salesforce on Bare... Anubhav Dhoot & Mayank Kumar — Salesforce¶

Salesforce shares its architecture and four and a half years of war stories operating enterprise Kubernetes on bare metal.

▶ 7:23 … the ha proxy will load balance across the api servers for security we hardened all our communication from service to service across machines using …
▶ 21:16 … over the last 4.5 years the whole infrastructure has tight integrations with networking security and monitoring we have invested in watchdog monitoring alerting
Full transcript

2021 · KubeCon + CloudNativeCon Europe 2021¶

Elastisys shares its experience implementing GDPR compliance on a cloud native platform.

How DoD Uses K8s & Flux to Achieve Compliance & Deployment Consistency - M. Medellin & G. Tillman — DoD¶

2021 · KubeCon + CloudNativeCon North America 2021¶

Sigstore: How We Started, Where We Are, Where We are Headed - Bob Callaway & Dan Lorenc ¶

2022 · KubeCon + CloudNativeCon Europe 2022¶

Fun with Continuous Compliance - Ann Wallace, Shopify & Zeal Somani, Google — Shopify¶

Shopify, with Google, shares how it approaches continuous compliance for its Kubernetes infrastructure.

Threat Hunting at Scale: Auditing Thousands of Clusters With Falco + F... Furkan Türkal & Emin Aktaş ¶

Real World SPIFFE Scenarios and Outcomes - Andres Vega & Frederick Kautz, SPIFFE Steering Committee — SPIFFE Steering Committee¶

2022 · KubeCon + CloudNativeCon North America 2022¶

How the Argo Project Transitioned From Security Aware To Security First - Henrik & Michael Crenshaw ¶

From Security Testing To Deployment In a Single PR - Sarah Khalife, GitHub & Grant Griffiths — GitHub¶

What We Learned From the Gateway API: Designing Linkerd’s New Policy CRD - Matei David, Buoyant, Inc — Buoyant, Inc¶

2023 · KubeCon + CloudNativeCon Europe 2023¶

InSPIREing Progress: How We're Growing SPIFFE & SPIRE in 2023 & Beyond- Daniel Feldman & Andrés Vega ¶

Paved Paths Leading the Way to Compliance - Kasper Borg Nissen & Brian Nielsen, Lunar — Lunar¶

Lunar describes how paved paths helped it achieve compliance.

2023 · KubeCon + CloudNativeCon NA 2023¶

Open and Secure: Lessons Learned in Five Years of TAG Security Assess... Justin Cappos & Andres Vega ¶

SECURITY HUB: From Threats to Trust: Safeguarding Sensitive Data in K8s - Moritz Eckert ¶

SECURITY HUB UNCONFERENCE: Seccomp policy usage: why there is no adoption?¶

Deploying Kubernetes in Classified Environments - Vlad Ungureanu & Ali Monfre, Palantir Technologies — Palantir¶

Palantir shares how it deploys and operates Kubernetes in classified environments.

Software Delivery in Regulated Environments: Critical Infrastructure... Austen Bryan & Steven Ollek ¶

Speakers share experience delivering software in regulated, critical-infrastructure environments.

Real-World Knative: Success Stories from Production Environments...¶

Four guest speakers describe how their organizations use Knative in production.

▶ 23:22 garciaa I am an open source engineer with chenard uh uh we are a supply chain security company for those are familiar with the …
▶ 24:04 uh charden force uh chard enforces is our um supply chain security uh uh control plane if you want to uh see it like …
Full transcript

2024 · KubeCon + CloudNativeCon + Open Source Summit + AI_dev China 2024¶

Strengthening Container Security: A Collaborative Journey - Yi Zha & Beltran Rueda Borrego ¶

Ensuring Success with Kyverno in Production: What You Must Know - Shuting Zhao ¶

2024 · KubeCon + CloudNativeCon Europe 2024¶

No 'Soup' for You! Enforcing Network Policies for Host Processes via eBPF - Vinay Kulkarni, eBay — eBay¶

eBay describes enforcing network policies on host processes with eBPF in its own infrastructure.

Search at Shopify: Highly Available Platform for Data Resilience and Compliance - Leila Vayghan — Shopify¶

Lessons Learned from Generating 100M SBOMs: Google’s Approach to SBOM Compliance ¶

From Chaos to Control: Cloud Native Governance with Kyverno! — DE-CIX¶

DE-CIX describes using Kyverno policies to govern its Kubernetes environment, plus recent additions and the project roadmap.

Full transcript

Securing the Supply Chain with Sigstore Artifacts Signatures at Scale ¶

2024 · KubeCon + CloudNativeCon NA 2024 - Salt Lake City¶

Multi-Tier Security in WasmCloud: From Developer Constraints to Platform Extensibility - B. Townsend ¶

2025 · KubeCon + CloudNativeCon Europe 2025 - London¶

EVAPorating Kubernetes Security Risk: Adopting Validating Admission P... Kaitlyn Lee & Jordan Conard ¶

Zero Trust at Shopify Scale: Automating MTLS Across Thousands of Serv... Dani Santos & Michelle Mali — Shopify¶

2025 · KubeCon + CloudNativeCon North America 2025¶

Patch Me If You Can: Tackling Outdated Addons Before They Become... Stevie Caldwell & Andy Suderman ¶

Practitioners share how they handle outdated cluster addons before they turn into security and operational problems.

From Bespoke To Bulletproof: SPIFFE/SPIRE With ESO for Enterprise Zero... May Large & Ivy Alkhaz ¶

Adopting a Fleet-first Mindset - Andy Beane, Spotify — Spotify¶

Spotify explains how adopting a fleet-first mindset and its Fleetshift platform enabled fleet-wide changes at scale.

▶ 3:38 … migrating to a new service, tool, or framework, uh patching a security vulnerability or resolving a production incident. It could also be an infrastructure …
▶ 4:22 … It patches known security holes. It's faster and more performant and
▶ 13:09 … So some examples of these or a recurring change include dependency updates, uh security patches or security vulnerabilities, or some sort of config updates …
Full transcript

2026 · KubeCon + CloudNativeCon India 2026¶

Zero Trust for Fintech: Building Secure Banking Infrastructure Wit... Prasta Maha & Herbert Sianturi ¶

Describes building secure zero-trust banking infrastructure for fintech on cloud native tooling.

2026 · KubeCon + CloudNativeCon Japan 2026¶

Runtime Security at Scale With EBPF: Hybrid Detection and Root Cause… Y. Krishna Kota & R. Waghare ¶

User Namespaces in Production: Enabling Root in Containers With RWX - Kohei Sugihara & Toru Komatsu — Preferred Networks¶

Describes running user namespaces in production to enable root inside containers with RWX storage.

References¶

Videos