05-19, 12:15–12:45 (UTC), Main Hall
In late 2017 and throughout 2018 we witnessed the advent of a new class of CPU-level information disclosure vulnerabilities, commonly known as “Spectre”, “Meltdown”, and (later in 2018) “Level 1 Terminal Fault” (l1tf in short, also known as “Foreshadow”).
This talk will give a brief introduction of related CPU design concepts and their concrete exploitation by the above-mentioned vulnerabilities, and discuss available mitigations.
After we’ve established (or refreshed) our knowledge of the problem field, the main part of the talk will focus on keeping your Kubernetes clusters secured from those vulnerabilities: we will take a full-stack approach and look at common OS and container abstraction layers in cloud-native scenarios individually - bare metal kernel space, user space, (optional) virtualization, and container runtime - to discuss weaknesses and mitigations at each of the layers.
The talk aims to raise awareness as well as spread in-depth understanding of the impact CPU information disclosure flaws have on Kubernetes and its workloads.
Our motivation is to educate our audience to empower folks to be able able to judge by themselves whether their workloads are secure, and to provide options and mitigations should workloads be at risk. Knowledge from this session will help the community to better understand this new vulnerability class, and to maintain security in Kubernetes deployments.
The talk will roughly follow the path of our blog post on the impact of hardware security vulnerabilities in cloud-native environments: https://kinvolk.io/blog/2019/03/hardware-vulnerabilities-in-cloud-native-environments/ .
Thilo started his FOSS life as a Linux kernel developer / systems architect more than 15 years ago. After an initial focus on embedded systems he worked for multiple cloud providers specialising in virtualization, both as an engineer and in technical management. In early 2019 Thilo joined Kinvolk, adding lower level OS knowledge to aid our mission of keeping Kubernetes safe and secure.