Loading…
In-person + Virtual
October 11-15
Learn More and Register to Attend

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for KubeCon + CloudNativeCon North America 2021 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

Please note: This schedule is automatically displayed in Pacific Daylight Time (UTC -7). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date." The schedule is subject to change.
Back To Schedule
Thursday, October 14 • 11:00am - 11:35am
Fine-Grained User Authorization for Kubernetes with OPA and LDAP - Cagri Cetin & Quentin Long, Yelp Inc.

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
Yelp recently migrated their container-orchestration system from Mesos to Kubernetes. However, existing Kubernetes authorization mechanisms were insufficient to implement least-privilege access control rules. Yelp needed to authorize its users to hundreds of services owned by hundreds of different teams. By leveraging the Open Policy Agent (OPA), Yelp has implemented an authorization system that allows defining fine-grained authorization rules: These can rely on service ownerships, resources’ or actions’ sensitivity levels. This talk covers Yelp’s journey to a fine-grained Kubernetes authorization using OPA and LDAP. It will discuss: - Shortcomings of existing Kubernetes authorization mechanisms - Design details of the new OPA-based system - Strategies for provisioning authorization rules at scale - Migration to the new system with zero downtime - Issues encountered along the way and lessons learned
Speakers
avatar for Cagri Cetin

Cagri Cetin

Security Engineer, Yelp Inc
Cagri (Charlie) Cetin is a Security Engineer at Yelp Inc. working as a tech lead in the Identity and Access Management team. He received a Ph.D. in Computer Science from the University of South Florida focusing on access control and cryptographic protocols. His interests include enforcing... Read More →
QL

Quentin Long

Security Engineer, Yelp inc.

[Kubecon 2021] Kubernetes AuthNZ with Okta and OPA at Yelp pdf
Thursday October 14, 2021 11:00am - 11:35am PDT
Concourse Hall 151 + Online
  Security + Identity + Policy