We’re going to talk about the different layers that make up a Kubernetes cluster and how the stack of different projects and re-use of older Linux primitives makes good multi-tenant security hard to achieve. We’ll also look at some of the risks of breakout from containers down to shared cluster nodes, how the Kubernetes authorization system has edge cases that can allow for privilege escalation and why the networking model implemented by Kubernetes does not lend itself to scenarios where hostile tenants are present, especially as Kubernetes is SSRF as a service!

We’ll also look at a high-level at how these problems can be solved and the trade-offs of different approaches to improving multi-tenant Kubernetes cluster security, so that attendees can make informed decisions on where they want to place the security boundaries in their Kubernetes environments.

This talk was delivered at 44CON 2026.

Have you ever thought about giving a talk at a conference or meet-up, but haven’t been sure where to start? Are there things you wish you’d known before getting up on stage for the first time? This talk will answer those questions for you giving you the information you need to get started speaking at meet-ups and conferences.

Based on 17 years of conference presentation delivery, I’ll be sharing what worked for me and also what didn’t, and providing some practical examples of how you can help ensure your first or next talk is a success.

This talk was delivered at Steelcon 2026. There’s a video here and a companion website with some more info here

So that leads us to a question, if LLMs can do Kubernetes related tasks, can they do them securely and what in general do the know and not know about Kubernetes security?

This talk will show the results of our research into how LLMs handle Kubernetes security tasks, how techniques like improved prompting can change the outcomes, and the places where they fall down.

This talk was delivered as a keynote at Kubecon EU 2026. There’s a video of the talk here, and a website with all the results, which has been extensively maintained and expanded since the talk, here

This talk was delivered as a keynote at KCD UK 2025

In this talk we’ll get into the details of how Kubernetes based network stacks work and detail specific places and detail specific places that are vulnerable to attack. We’ll start with the low level aspect of Linux networking that have been re-purposed for container stacks, looking at how those settings can leave clusters exposed to attacks, then talk about some higher level HTTP concerns like the fact that every cluster is SSRF as a service, and demonstrate tools that allow for port-scanning via the Kubernetes API server.

We’ll also talk about how Kubernetes cluster network security operates and focus on how those controls can be rendered useless by users making mistakes, or by attackers deliberately.

This talk was delivered at 44Con 2025

This tutorial was delivered at RSAC 2025, and can be accessed if you have an RSAC membership on their site

We’ll be exploring some of the in-depth parts of cluster architecture that you may not get to look at every day with hands-on exercises that you can try out during the tutorial or takeaway and work on later.

So if you’ve ever wondered what the Kubelet API is, how Kubernetes does authentication or authorization or how someone could use “the most pointless Kubernetes pod ever” to get root access to your cluster nodes, then join us and find out!

This tutorial was delivered at Kubecon EU 2025, and there’s a video recording of it here

This talk will examine how attackers can (ab)use little known features of Kubernetes and the components that are commonly deployed as part of cloud-native containerized workloads to persist in compromised systems, sometimes for years at a time. We’ll also pinpoint places where, if you don’t detect the initial attack, it might be very difficult to spot the attacker lurking in your cluster.

This talk was delivered at Cloud Native Rejekts 2024, Insomni’hack 2025, and OWASP Appsec EU 2025, there’s a recording from Insomni’hack here

This talk will examine the sources of success that these technologies had, look at what seems like it should have been important but wasn’t, and provide ideas for how future open source projects can set themselves up for success.

This talk was delivered at the State Of Open Con 2025, and there’s a video of the talk here

🔑 Key Topics:

Identifying key areas in Kubernetes security and understanding default settings
Practical advice on enhancing security beyond default configurations
Tailored recommendations for cluster operators and application developers
Strategies for creating secure, production-ready Kubernetes environments

This talk equips you with actionable insights to fortify your Kubernetes clusters against potential vulnerabilities, ensuring secure deployments that align with industry best practices.

This talk was delivered at KCD Austria and there’s a video available here