Search Results for "problem a"

...IAM roles are attributed through instance profiles and are accessible by services through the transparent usage by the aws-sdk of the ec2 metadata API. When using the aws-sdk, a call is made to the EC2 metadata API which provides temporary credentials that are then used to make calls to the AWS service. The problem is that in a multi-tenanted containers based world, multiple containers will be sharing the underlying nodes. Given containers will share the same underlying nodes, providing access to AWS resources via IAM roles would mean that one needs to create an IAM role which is a union of all IAM roles. This is not acceptable from a security perspective.

The Vault Swiss Army knife, which makes enterprise-grade security attainable on Kubernetes. It has many 'blades' that cut through the security problem: the Bank-Vaults operator provides automation; a Go client with automatic token renewal that provides dynamic secret generation, multiple unseal options, and more; a CLI tool to initialize, unseal and configure Vault with authentication methods and secret engines; and direct secret injection into Pods to reduce the attack surface. ...

...Kubicorn will be going through a breaking API change as we adopt the upstream cluster API. kubicorn is a free and open source project that solves the Kubernetes infrastructure problem and gives users a rich Golang library to work with infrastructure. unicorn is a project that helps a user manage cloud infrastructure for Kubernetes. With kubicorn a user can declaratively create new clusters, and modify and scale them.