Sascha Grunert’s Tweets

Secure your Kubernetes deployments with eBPF | Red Hat Developer

Dec 16

I published a blog post about how to record #seccomp profiles using eBPF and the Security Profiles Operator in #Kubernetes: developers.redhat.com/articles/2021/ It also covers how to build and deploy a containerized bpf application as well as technical details of the syscall recorder. 🙂

developers.redhat.com

Numerous adaptations of the Linux kernel—notably seccomp, SELinux, and AppArmor—bolster its security through runtime checks on sensitive activities such as file access and system calls (syscalls). In...

12

35

Dec 14

As end of the year gift, we released v0.4.0 of the #Kubernetes Security Profiles Operator! 🥳 github.com/kubernetes-sig It contains many new features, like log based seccomp and SELinux profile recording, an eBPF seccomp recorder, AppArmor support as well as metrics!

Release v0.4.0 · kubernetes-sigs/security-profiles-operator

Welcome to our glorious next release of the security-profiles-operator! We hope you enjoy this release as much as we do! The general usage and setup can be found in our documentation.

To...

30

56

Dec 11

This is my personal favorite espresso, I hope you enjoy it as much as I do! 🤗🤤 Actually, a pretty local roasting house from your perspective.

Quote Tweet

Carlos Panato

@comedordexis

· Dec 11

And we got a fantastic Xmas gift from my friend @saschagrunert Vielen Danke Meine Freunde

1

8

Dec 6

I got this awesome Christmas gift from

@puerco

and

@comedordexis

! 🎄😭 Thank you so much and enjoy the Christmas season! Let’s see if my baby fits into it. 😅 #relengFam

2

21

Nov 29

The Kubernetes project is working towards security hardening their software supply chain! 🙂 I'd like to share our SIG Release Roadmap and Vision update, which covers full SLSA compliance as well as how to sign our release artifacts: groups.google.com/g/kubernetes-d

34

108

Topics to follow

Sign up to get Tweets about the Topics you follow in your Home timeline.

Carousel

Nov 14

Today I submitted two talks for #KubeCon Europe 2022 in Valencia! 🇪🇸 I’m trying something new this time by proposing one talk in the community track. Submit your talks, folks. The CFP closes on Dec 18!

23

Oct 25

Found the issue: The clang wrapper (a shell script wrapping the binary before execution) does not support the `-target` argument and therefore does not pass it down to the clang CLI. Additionally adding `--extra-sandbox-paths /sys` makes building bpf modules in nixpkgs work.

1

Strangely, I cannot compile the bpf object with nix, because clang/llvm reports: fatal error: error in backend: Cannot select: intrinsic %llvm.preserve.struct.access.index Tried clang 10/11/12, maybe

@grhmc

or any other of you folks have an idea… 🤔

Add bpf based syscall recorder by saschagrunert · Pull Request #618 · kubernetes-sigs/security-pr...

What type of PR is this? /kind feature What this PR does / why we need it: This change adds a new syscall recorder "bpf" which uses an ebpf module to record the syscalls based on ...

1

2

4

I'm working on a bpf based syscall recorder for the Kubernetes Security Profiles Operator: github.com/kubernetes-sig It works without any third party dependency, is able to unload the bpf module on demand and will run on x86_64 as well as arm64 Linux. 😊

Add bpf based syscall recorder by saschagrunert · Pull Request #618 · kubernetes-sigs/security-pr...

What type of PR is this? /kind feature What this PR does / why we need it: This change adds a new syscall recorder "bpf" which uses an ebpf module to record the syscalls based on ...

2

13

74

I've built an eBPF/libbpf based syscall recorder, which has no further runtime dependencies when linked statically. github.com/saschagrunert/ It can be wrapped as OCI hook for recording inside Kubernetes, but I'm also considering a solution which works with

@containerd

, in Rust.

GitHub - saschagrunert/syscall-recorder: ebpf syscall recording demo project

ebpf syscall recording demo project. Contribute to saschagrunert/syscall-recorder development by creating an account on GitHub.

11

43

💕 #SIGReleaseFam at #KubeCon day 2 keynote. SIG Release has a special place in my ❤️

4

22

Oct 14

This is me! 🥸👇 #KubeCon

Quote Tweet

Carlos Panato

@comedordexis

· Oct 14

some updates in CRIO-O with @saschagrunert #kubecon

1

22

Stephen Augustus (he/him)

@stephenaugustus

Oct 13

My #Kubernetes #RelEngFam is crushing right now at "Hardening the Kubernetes Software Supply Chain Through Better Transparency" - #KubeCon + #CloudNativeCon

kccncna2021.sched.com

KubeCon + CloudNative North America 2021: Hardening the Kubernetes Software Supply...

View more about this event at KubeCon + CloudNative North America 2021

1

6

26

Don't miss our #KubeCon NA talk tomorrow 11am PT / 8pm CEST about: "What's New in CRI-O?" - with

@mrunalp

,

@umohnani8

,

@haircommander

and myself.

kccncna2021.sched.com

KubeCon + CloudNative North America 2021: What's New in CRI-O? - Mrunal Patel, Urv...

View more about this event at KubeCon + CloudNative North America 2021

10

Stephen Augustus (he/him)

@stephenaugustus

Oct 7

Thank you for all of your hard work this year, #Kubernetes #RelEngFam! Let's keep pushing together :)

Quote Tweet

· Oct 7

In @kubernetesio SIG Release we maintain our own roadmap and vision to track our long term efforts. Our main goal is to establish a consumable, introspectable, and secure software supply chain for #Kubernetes.

Now it’s going to get its first update

github.com/kubernetes/sig

2

5