CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity

•

0 likes•146 views

Identities are a crucial part of running workloads on Kubernetes. How do you ensure Pods can securely access Cloud resources? In this lightning talk, you will learn how large Cloud providers work together to share Identity Provider responsibilities in order to federate identities in multi-cloud environments.

Don’t Make
Me
Impersonate
My Identity
Lightning Talk
Cynthia Thomas
linkedin.com/in/cynthia-thomas, @_techcet_
GKE Security, Google Cloud

Kubernetes Pods and their identities
- In Kubernetes, Pods are given a distinct identity
within a Kubernetes cluster
- How? Through a Service Account: typically an
account type for non-humans
- Pods are always given Service Accounts by default or
configured

How to get Pods to talk to Cloud Resources
Options:
1. Export credentials and mount as a Kubernetes
secret in the Pod at runtime
2. Use the worker node/VM identity credential
3. Use Workload Identity Federation

Cloud provider
K8s Cluster
K8s Worker Nodes
K8s Worker Nodes
K8s Worker Nodes
Namespace foo
Pod Pod
K8s Control Plane
kube-API server
Workload Identity Federation at work
Step 2: Secured
communication
Cloud IAM
Cloud API
Step 1: Trust
Established
Blog: Kubernetes token support for OIDC

Before After
Create Kubernetes namespace Create Kubernetes namespace
Create Kubernetes Service Account
(KSA)
Create Kubernetes Service Account
(KSA)
Create Google Service Account Not needed
Configure KSA to impersonate GSA Not needed
Annotate KSA with the GSA so GKE
knows the link
Not needed
Bind role to Google Service Account
(GSA)
Bind role directly to KSA
SA
Impersonation
Just say no to impersonation

- Dont worry about managing secrets
- Dont worry about identity impersonation
- Federate identities - supports OIDC/SAML and now X.509
certificates with SPIFFE
Don’t make me impersonate my identity
Be more secure with Workload Identity Federation!

Similar to CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity

Consolidating Infrastructure with Azure Kubernetes Service

Eng Teong Cheah

SharePoint 2010, Claims-Based Identity, Facebook, and the Cloud

Danny Jessee

This document provides information about Danny Jessee, a senior software engineer with 8 years of SharePoint development experience. It includes his credentials, contact information, and topics he can present on, such as features of secure applications, SharePoint 2010 authentication options, claims terminology and technology overview. It also lists some demos he can provide, including setting up a new SharePoint 2010 web application, integrating Facebook authentication using Azure AppFabric ACS, and further integrating Facebook data into SharePoint using the Facebook C# SDK.

Overview of secret management solutions and architecture

Yuechuan (Mike) Chen

The document provides an overview of secret management solutions and architectures. It discusses what secrets are and why secret management is important. Some key points: - Secrets include authentication credentials, API keys, passwords, and certificates that need access control. As services increase, so do secrets. - An ideal secret management solution provides security, encryption, access control, auditing, ease of use, and integration with other tools. - Version control systems and orchestration tools like Kubernetes can be used for secrets but have limitations compared to dedicated secret management solutions. - AWS offers Parameter Store, Secrets Manager, and KMS for secret management. Parameter Store is generally recommended, while Secrets Manager is better for database

(DEV203) Amazon API Gateway & AWS Lambda to Build Secure APIs

Amazon Web Services

Amazon API Gateway is a fully managed service that makes it easy for developers to create, deploy, secure, and monitor APIs at any scale. In this presentation, you’ll find out how to quickly declare an API interface and connect it with code running on AWS Lambda. Amazon API Gateway handles all of the tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls, including traffic management, authorization and access control, monitoring, and API version management. We will demonstrate how to build an API that uses AWS Identity and Access Management (IAM) for authorization and Amazon Cognito to retrieve temporary credentials for your API calls. We will write the AWS Lambda function code in Java and build an iOS sample application in Objective C.

Securing Serverless Workloads with Cognito and API Gateway Part I - AWS Secur...

Amazon Web Services

The document discusses securing serverless applications using Amazon API Gateway, AWS Lambda, and Amazon Cognito. It describes how to build a basic 3-tier web app that is fully serverless, add authentication with Amazon Cognito by integrating with Cognito user pools, and implement authorization using AWS Identity and Access Management (IAM) by leveraging Cognito. Key benefits mentioned are that AWS Lambda and API Gateway provide automatic scaling with no infrastructure to manage, while security is improved by making use of IAM through Cognito.

Building Powerful IoT Apps with AWS IoT and Websockets

Amazon Web Services

Deploying Compliant Kubernetes: Real World Edge Cases

DevOps.com

This document discusses Lola's deployment of compliant Kubernetes to meet PCI DSS requirements. Lola stores credit card details on behalf of users but does not directly process payments, requiring Level 1 PCI compliance. It outlines how Lola uses technologies like TLS encryption with Ingress controllers, IAM authentication for Kubernetes, and Prometheus for cluster monitoring to meet requirements for firewalls, encryption, secure systems, and access control. The document advises engaging auditors technically rather than treating Kubernetes as a black box, and leveraging open source tools and communities for pre-built applications to simplify compliance tasks like authentication, monitoring, and logging.

Deep Dive on Amazon Cognito - DevDay Austin 2017

Amazon Web Services

Amazon Cognito is a service that provides authentication, authorization, and user management for web and mobile applications. It allows for user sign-up, sign-in, access control, account recovery, and integration with social identity providers. Cognito User Pools provides built-in user directory and authentication services, while Cognito Identity Pools enables the generation of temporary AWS credentials for application access. Sample use cases include business to consumer apps, business to employee apps, and IoT applications.

CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0

Krishna-Kumar

Amazon Cognito Deep Dive

Amazon Web Services

by Fritz Kunstler, Sr. AWS Security Consultant AWS Join us for four days of security and compliance sessions and hands-on labs led by our AWS security pros during AWS Security Week at the San Francisco Loft. Join us for all four days, or pick just the days that are most relevant to you. We'll open on Monday with Security 101 day, followed by sessions Tuesday on Identity and Access Management, our popular Threat Detection and Remediation day Wednesday will feature an updated GuardDuty lab, and we'll end Thursday with Incident Response sessions, labs, and a talk by Netflix on their new open source IR tool. This week will also feature Dome9 as a sponsor, and you can hear them speak and present a hands-on workshop Monday during Security 101 day.

How to implement authorization in your backend with AWS IAM

Provectus

AWS Dev Day Kyiv 2019 Track: Backend & Architecture Session: ""How to implement authorization in your backend with AWS IAM"" Speaker: Stas Ivaschenko, AWS solutions architect at Provectus Level: 400 Video: https://www.youtube.com/watch?v=4Jje_WJ4V7Q AWS Dev Day is a free, full-day technical event where new developers will learn about some of the hottest topics in cloud computing, and experienced developers can dive deep on newer AWS services. Provectus has organized AWS Dev Day Kyiv in close collaboration with Amazon Web Services: 800+ participants, 18 sessions, 3 tracks, a really AWSome Day!  Now, together with Zeo Alliance, we're building and nurturing AWS User Group Ukraine — join us on Facebook to stay updated about cloud technologies and AWS services: https://www.facebook.com/groups/AWSUserGroupUkraine "

K8s hard-way on DigitalOcean

CloudYuga

Fiware cloud developers week brussels

Fernando Lopez Aguilar

- The FIWARE Lab provides cloud hosting and infrastructure as a service capabilities including compute, network, storage, and PaaS functionality. - It utilizes OpenStack for core infrastructure services including compute (Nova), networking (Neutron), storage (Cinder, Swift), and identity (Keystone). - The PaaS Manager allows users to define templates called Blueprints to deploy multi-tier applications and software stacks across the virtual infrastructure in an automated manner.

Lamdba micro service using Amazon Api Gateway

Mike Becker

Certification authority

proser tech

This document discusses certificate authorities (CAs) and provides an example scenario for securing a web server using a CA. It defines a CA as an entity that issues digital certificates for use by other parties in public key infrastructure schemes. There are commercial CAs, as well as CAs run by institutions and governments. The document then describes the process a CA goes through to issue a certificate and how users can verify certificates. It provides a list of common CAs. Finally, it presents a scenario where a web server obtains a server certificate from a CA to secure its SSL port, and clients can obtain client certificates from the CA's website to access the secure site.

Azure AD B2C Webinar Series: Identity Protocols OIDC and OAuth2 part 2

Vinu Gunasekaran

This document summarizes a webinar about integrating Azure Active Directory B2C (AAD B2C) with applications using the Microsoft Authentication Libraries (MSAL). It discusses how MSAL can be used to acquire tokens to call protected APIs and validate tokens in web APIs and applications. It provides an overview of using MSAL in .NET Core web apps to sign users in with AAD B2C, redeem authorization codes to acquire tokens, and implement token caching for silent authentication. The document demonstrates how to build a .NET Core web app that signs users in with AAD B2C using MSAL.

DEVNET-1120 Intercloud Fabric - AWS and Azure Account Setup and Utilization

Cisco DevNet

The document provides an agenda and overview for a session on setting up accounts with Intercloud Fabric on AWS and Azure. It discusses the steps required to set up accounts on each platform, including creating credentials, configuring policies and permissions, and connecting Intercloud Fabric. The conclusion encourages participants to ask questions and provides information on related sessions at Cisco Live.

Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks

Amazon Web Services

Aws(sdk)

Futada Takashi

Introduction to Amazon EKS - KubeCon 2018

Arun Gupta

Amazon EKS (Elastic Kubernetes Service) is a managed service that makes it easy to run Kubernetes on AWS. It handles provisioning and managing control plane resources so users can focus on applications. EKS provides a native Kubernetes experience while integrating seamlessly with other AWS services to eliminate undifferentiated heavy lifting. The EKS team actively contributes to the open source Kubernetes project.

Similar to CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity (20)

Consolidating Infrastructure with Azure Kubernetes Service

SharePoint 2010, Claims-Based Identity, Facebook, and the Cloud

Overview of secret management solutions and architecture

(DEV203) Amazon API Gateway & AWS Lambda to Build Secure APIs

Securing Serverless Workloads with Cognito and API Gateway Part I - AWS Secur...

Building Powerful IoT Apps with AWS IoT and Websockets

Deploying Compliant Kubernetes: Real World Edge Cases

Deep Dive on Amazon Cognito - DevDay Austin 2017

CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0

Amazon Cognito Deep Dive

How to implement authorization in your backend with AWS IAM

K8s hard-way on DigitalOcean

Fiware cloud developers week brussels

Lamdba micro service using Amazon Api Gateway

Certification authority

Azure AD B2C Webinar Series: Identity Protocols OIDC and OAuth2 part 2

DEVNET-1120 Intercloud Fabric - AWS and Azure Account Setup and Utilization

Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks

Aws(sdk)

Introduction to Amazon EKS - KubeCon 2018

More from Cynthia Thomas

KubeCon NA'22 Lightning Talk: Where did all my IPs go?

Cynthia Thomas

Kubernetes cluster planning requires quite a few things to get started. What about IPs? Common IP management hurdles with Kubernetes clusters include IP assignments when building a cluster and challenges faced when deploying in a multi-faceted environment. Kubernetes Admins often need to use IP addressing handed out by Network Admins juggling other non-k8s workload IP assignments and IP exhaustion. In this talk, Cynthia will discuss new and existing KEPs that SIG-network has implemented to help mitigate IP challenges. Such features include discontiguous cluster CIDRs and the journey to IPv6. Cynthia will also discuss how the best practices for Kubernetes IP management are changing with these new capabilities to help scale and grow instead of rebuild. https://sched.co/184sj

Kernel advantages for Istio realized with Cilium

Cynthia Thomas

Istio brings a myriad of options to provide routing rules, encryption, and monitoring for microservices, typically in container environments. Cilium provides accelerated network security using a modern kernel technology called BPF. Put the two together and what do you get? A distributed security solution enabling microservices traffic management, security, and monitoring while enforcing policy as close to the microservices as possible. Cynthia Thomas and Romain Lenglet discuss the architectural and performance benefits of using Cilium with Istio and provide a demo of this BPF-based, Linux kernel technology. Cilium provides an API-aware security solution that can make a decision on every single microservice flow, with the ability to enforce protocols such as HTTP, Kafka, and gRPC. By addressing security policy at the API layer, you can enforce policy efficiently with kernel capabilities while reducing the attack surface in a microservices deployment.

Cilium:: Application-Aware Microservices via BPF

Cynthia Thomas

Cilium: Seattle Kubernetes MeetUp Dec 2017

Cynthia Thomas

BPF (Berkeley Packet Filter) is becoming the fastest growing technology in the Linux kernel and is revolutionizing networking, security and tracing. At the same time, the rise of container-based orchestration platforms such as Kubernetes is creating demand for routing, load-balancing & security infrastructure that is highly scalable, application-aware, and resilient. This talk introduces the open source project Cilium - a modern networking and security platform for microservices. Cilium is built on top of BPF and provides Linux native networking and security services with application protocol awareness. Cilium works hand in hand with application proxies such as Envoy and the services management orchestration layer Istio to provide infrastructure services in a transparent manner and with minimal overhead. This talk will discuss the challenges of exposing services via APIs and the solution that Cilium provides to enforce least privilege security.

Cilium – Kernel Native Security & DDOS Mitigation for Microservices with BPF

Cynthia Thomas

We have introduced Cilium at DockerCon US 2017 this year. Cilium provides application-aware network connectivity, security, and load-balancing for containers. This talk will follow up on the introduction and deep dive into recent kernel developments that address two fundamental questions: How can I provide application-aware security and routing efficiently without overhead embedded into every service? How can container hosts protect themselves from internal and external DDoS attacks? The solutions include: kproxy: a kernel-based socket proxy which allows for application-aware routing and security enforcement with minimal overhead. XDP: A lightning-fast packet processing datapath using BPF. The technology is intended for DDoS mitigation, load-balancing, and forwarding. This talk will deep dive into these exciting technologies and show how Cilium makes BPF and these kernel features available on Linux for your Docker containers.

Secure Your Containers: What Network Admins Should Know When Moving Into Prod...

Cynthia Thomas

Midokura @ OpenStack Seattle

Cynthia Thomas

What's the deal with Neutron?

Cynthia Thomas

CloudKC: Evolution of Network Virtualization

Cynthia Thomas

This document discusses the evolution of network virtualization. It begins with an overview of using VLANs for network virtualization, which provides L2 isolation but has limitations around scalability and management. OpenFlow is presented as an early approach that uses a centralized controller but has performance impacts. The document then introduces network overlays using software-defined networking as a more advanced approach, allowing network services to be decoupled from physical network hardware for improved scalability, agility and fault tolerance. It provides an overview of using the Midokura network virtualization platform with OpenStack Neutron for network automation and management.

From Nova-Network to Neutron and Beyond: A Look at OpenStack Networking

Cynthia Thomas

This document provides an overview of the evolution of network virtualization and OpenStack networking. It describes how networking started with manually configured VLANs, moved to OpenFlow which required programming flows, and then to network overlays using software defined networking. It outlines the requirements for network virtualization. It also details the evolution of OpenStack networking from Nova network to Quantum/Neutron, including the transition to using overlays and supporting plugins. Key features of Neutron are summarized, as well as upcoming features planned for future OpenStack releases.

More from Cynthia Thomas (10)

KubeCon NA'22 Lightning Talk: Where did all my IPs go?

Kernel advantages for Istio realized with Cilium

Cilium:: Application-Aware Microservices via BPF

Cilium: Seattle Kubernetes MeetUp Dec 2017

Cilium – Kernel Native Security & DDOS Mitigation for Microservices with BPF

Secure Your Containers: What Network Admins Should Know When Moving Into Prod...

Midokura @ OpenStack Seattle

What's the deal with Neutron?

CloudKC: Evolution of Network Virtualization

From Nova-Network to Neutron and Beyond: A Look at OpenStack Networking

Recently uploaded

How RPA Help in the Transportation and Logistics Industry.pptx

SynapseIndia

Cookies program to display the information though cookie creation

shanthidl1

What’s New in Teams Calling, Meetings and Devices May 2024

Stephanie Beckett

Calgary MuleSoft Meetup APM and IDP .pptx

ishalveerrandhawa1

一比一原版(msvu毕业证书）圣文森山大学毕业证如何办理

uuuot

原版一模一样【微信：741003700 】【(msvu毕业证书）圣文森山大学毕业证成绩单】【微信：741003700 】学位证，留信学历认证（真实可查，永久存档）原件一模一样纸张工艺/offer、在读证明、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。本公司拥有海外各大学样板无数，能完美还原。 1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700 【主营项目】一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！二.真实使馆公证(即留学回国人员证明,不成功不收费) 三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度) 如果您处于以下几种情况： ◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】 ◇面对父母的压力，希望尽快拿到； ◇不清楚认证流程以及材料该如何准备； ◇回国时间很长，忘记办理； ◇回国马上就要找工作，办给用人单位看； ◇企事业单位必须要求办理的 ◇需要报考公务员、购买免税车、落转户口 ◇申请留学生创业基金留信网认证的作用: 1:该专业认证可证明留学生真实身份 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳��资料，供国家高端企业选择人才办理(msvu毕业证书）圣文森山大学毕业证【微信：741003700 】外观非常简单，由纸质材料制成，上面印有校徽、校名、毕业生姓名、专业等信息。办理(msvu毕业证书）圣文森山大学毕业证【微信：741003700 】格式相对统一，各专业都有相应的模板。通常包括以下部分：校徽：象征着学校的荣誉和传承。校名:学校英文全称授予学位：本部分将注明获得的具体学位名称。毕业生姓名：这是最重要的信息之一，标志着该证书是由特定人员获得的。颁发日期：这是毕业正式生效的时间，也代表着毕业生学业的结束。其他信息：根据不同的专业和学位，可能会有一些特定的信息或章节。办理(msvu毕业证书）圣文森山大学毕业证【微信：741003700 】价值很高，需要妥善保管。一般来说，应放置在安全、干燥、防潮的地方，避免长时间暴露在阳光下。如需使用，最好使用复印件而不是原件，以免丢失。综上所述，办理(msvu毕业证书）圣文森山大学毕业证【微信：741003700 】是证明身份和学历的高价值文件。外观简单庄重，格式统一，包括重要的个人信息和发布日期。对持有人来说，妥善保管是非常重要的。

GDG Cloud Southlake #34: Neatsun Ziv: Automating Appsec

James Anderson

The lecture titled "Automating AppSec" delves into the critical challenges associated with manual application security (AppSec) processes and outlines strategic approaches for incorporating automation to enhance efficiency, accuracy, and scalability. The lecture is structured to highlight the inherent difficulties in traditional AppSec practices, emphasizing the labor-intensive triage of issues, the complexity of identifying responsible owners for security flaws, and the challenges of implementing security checks within CI/CD pipelines. Furthermore, it provides actionable insights on automating these processes to not only mitigate these pains but also to enable a more proactive and scalable security posture within development cycles. The Pains of Manual AppSec: This section will explore the time-consuming and error-prone nature of manually triaging security issues, including the difficulty of prioritizing vulnerabilities based on their actual risk to the organization. It will also discuss the challenges in determining ownership for remediation tasks, a process often complicated by cross-functional teams and microservices architectures. Additionally, the inefficiencies of manual checks within CI/CD gates will be examined, highlighting how they can delay deployments and introduce security risks. Automating CI/CD Gates: Here, the focus shifts to the automation of security within the CI/CD pipelines. The lecture will cover methods to seamlessly integrate security tools that automatically scan for vulnerabilities as part of the build process, thereby ensuring that security is a core component of the development lifecycle. Strategies for configuring automated gates that can block or flag builds based on the severity of detected issues will be discussed, ensuring that only secure code progresses through the pipeline. Triaging Issues with Automation: This segment addresses how automation can be leveraged to intelligently triage and prioritize security issues. It will cover technologies and methodologies for automatically assessing the context and potential impact of vulnerabilities, facilitating quicker and more accurate decision-making. The use of automated alerting and reporting mechanisms to ensure the right stakeholders are informed in a timely manner will also be discussed. Identifying Ownership Automatically: Automating the process of identifying who owns the responsibility for fixing specific security issues is critical for efficient remediation. This part of the lecture will explore tools and practices for mapping vulnerabilities to code owners, leveraging version control and project management tools. Three Tips to Scale the Shift Left Program: Finally, the lecture will offer three practical tips for organizations looking to scale their Shift Left security programs. These will include recommendations on fostering a security culture within development teams, employing DevSecOps principles to integrate security throughout the development

find out more about the role of autonomous vehicles in facing global challenges

huseindihon

Observability For You and Me with OpenTelemetry

Eric D. Schabell

Are you interested in dipping your toes in the cloud native observability waters, but as an engineer you are not sure where to get started with tracing problems through your microservices and application landscapes on Kubernetes? Then this is the session for you, where we take you on your first steps in an active open-source project that offers a buffet of languages, challenges, and opportunities for getting started with telemetry data. The project is called openTelemetry, but before diving into the specifics, we’ll start with de-mystifying key concepts and terms such as observability, telemetry, instrumentation, cardinality, percentile to lay a foundation. After understanding the nuts and bolts of observability and distributed traces, we’ll explore the openTelemetry community; its Special Interest Groups (SIGs), repositories, and how to become not only an end-user, but possibly a contributor.We will wrap up with an overview of the components in this project, such as the Collector, the OpenTelemetry protocol (OTLP), its APIs, and its SDKs. Attendees will leave with an understanding of key observability concepts, become grounded in distributed tracing terminology, be aware of the components of openTelemetry, and know how to take their first steps to an open-source contribution! Key Takeaways: Open source, vendor neutral instrumentation is an exciting new reality as the industry standardizes on openTelemetry for observability. OpenTelemetry is on a mission to enable effective observability by making high-quality, portable telemetry ubiquitous. The world of observability and monitoring today has a steep learning curve and in order to achieve ubiquity, the project would benefit from growing our contributor community.

How Netflix Builds High Performance Applications at Global Scale

ScyllaDB

[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf

Kief Morris

MYIR Product Brochure - A Global Provider of Embedded SOMs & Solutions

Linda Zhang

This brochure gives introduction of MYIR Electronics company and MYIR's products and services. MYIR Electronics Limited (MYIR for short), established in 2011, is a global provider of embedded System-On-Modules (SOMs) and comprehensive solutions based on various architectures such as ARM, FPGA, RISC-V, and AI. We cater to customers' needs for large-scale production, offering customized design, industry-specific application solutions, and one-stop OEM services. MYIR, recognized as a national high-tech enterprise, is also listed among the "Specialized and Special new" Enterprises in Shenzhen, China. Our core belief is that "Our success stems from our customers' success" and embraces the philosophy of "Make Your Idea Real, then My Idea Realizing!"

Coordinate Systems in FME 101 - Webinar Slides

Safe Software

If you’ve ever had to analyze a map or GPS data, chances are you’ve encountered and even worked with coordinate systems. As historical data continually updates through GPS, understanding coordinate systems is increasingly crucial. However, not everyone knows why they exist or how to effectively use them for data-driven insights. During this webinar, you’ll learn exactly what coordinate systems are and how you can use FME to maintain and transform your data’s coordinate systems in an easy-to-digest way, accurately representing the geographical space that it exists within. During this webinar, you will have the chance to: - Enhance Your Understanding: Gain a clear overview of what coordinate systems are and their value - Learn Practical Applications: Why we need datams and projections, plus units between coordinate systems - Maximize with FME: Understand how FME handles coordinate systems, including a brief summary of the 3 main reprojectors - Custom Coordinate Systems: Learn how to work with FME and coordinate systems beyond what is natively supported - Look Ahead: Gain insights into where FME is headed with coordinate systems in the future Don’t miss the opportunity to improve the value you receive from your coordinate system data, ultimately allowing you to streamline your data analysis and maximize your time. See you there!

Pigging Solutions Sustainability brochure.pdf

Pigging Solutions

Sustainability requires ingenuity and stewardship. Did you know Pigging Solutions pigging systems help you achieve your sustainable manufacturing goals AND provide rapid return on investment. How? Our systems recover over 99% of product in transfer piping. Recovering trapped product from transfer lines that would otherwise become flush-waste, means you can increase batch yields and eliminate flush waste. From raw materials to finished product, if you can pump it, we can pig it.

How to Avoid Learning the Linux-Kernel Memory Model

ScyllaDB

The Linux-kernel memory model (LKMM) is a powerful tool for developing highly concurrent Linux-kernel code, but it also has a steep learning curve. Wouldn't it be great to get most of LKMM's benefits without the learning curve? This talk will describe how to do exactly that by using the standard Linux-kernel APIs (locking, reference counting, RCU) along with a simple rules of thumb, thus gaining most of LKMM's power with less learning. And the full LKMM is always there when you need it!

What's New in Copilot for Microsoft365 May 2024.pptx

Stephanie Beckett

@Call @Girls Thiruvananthapuram 🚒 XXXXXXXXXX 🚒 Priya Sharma Beautiful And Cu...

kantakumariji156

@Call @Girls Guwahati 🚒 XXXXXXXXXX 🚒 Priya Sharma Beautiful And Cute Girl any...

kantakumariji156

Transcript: Details of description part II: Describing images in practice - T...

BookNet Canada

This presentation explores the practical application of image description techniques. Familiar guidelines will be demonstrated in practice, and descriptions will be developed “live”! If you have learned a lot about the theory of image description techniques but want to feel more confident putting them into practice, this is the presentation for you. There will be useful, actionable information for everyone, whether you are working with authors, colleagues, alone, or leveraging AI as a collaborator. Link to presentation recording and slides: https://bnctechforum.ca/sessions/details-of-description-part-ii-describing-images-in-practice/ Presented by BookNet Canada on June 25, 2024, with support from the Department of Canadian Heritage.

Quality Patents: Patents That Stand the Test of Time

Aurora Consulting

Is your patent a vanity piece of paper for your office wall? Or is it a reliable, defendable, assertable, property right? The difference is often quality. Is your patent simply a transactional cost and a large pile of legal bills for your startup? Or is it a leverageable asset worthy of attracting precious investment dollars, worth its cost in multiples of valuation? The difference is often quality. Is your patent application only good enough to get through the examination process? Or has it been crafted to stand the tests of time and varied audiences if you later need to assert that document against an infringer, find yourself litigating with it in an Article 3 Court at the hands of a judge and jury, God forbid, end up having to defend its validity at the PTAB, or even needing to use it to block pirated imports at the International Trade Commission? The difference is often quality. Quality will be our focus for a good chunk of the remainder of this season. What goes into a quality patent, and where possible, how do you get it without breaking the bank? ** Episode Overview ** In this first episode of our quality series, Kristen Hansen and the panel discuss: ⦿ What do we mean when we say patent quality? ⦿ Why is patent quality important? ⦿ How to balance quality and budget ⦿ The importance of searching, continuations, and draftsperson domain expertise ⦿ Very practical tips, tricks, examples, and Kristen’s Musts for drafting quality applications https://www.aurorapatents.com/patently-strategic-podcast.html

Research Directions for Cross Reality Interfaces

Mark Billinghurst

Recently uploaded (20)

How RPA Help in the Transportation and Logistics Industry.pptx

Cookies program to display the information though cookie creation

What’s New in Teams Calling, Meetings and Devices May 2024

Calgary MuleSoft Meetup APM and IDP .pptx

一比一原版(msvu毕业证书）圣文森山大学毕业证如何办理

GDG Cloud Southlake #34: Neatsun Ziv: Automating Appsec

find out more about the role of autonomous vehicles in facing global challenges

Observability For You and Me with OpenTelemetry

How Netflix Builds High Performance Applications at Global Scale

[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf

MYIR Product Brochure - A Global Provider of Embedded SOMs & Solutions

Coordinate Systems in FME 101 - Webinar Slides

Pigging Solutions Sustainability brochure.pdf

How to Avoid Learning the Linux-Kernel Memory Model

What's New in Copilot for Microsoft365 May 2024.pptx

@Call @Girls Thiruvananthapuram 🚒 XXXXXXXXXX 🚒 Priya Sharma Beautiful And Cu...

@Call @Girls Guwahati 🚒 XXXXXXXXXX 🚒 Priya Sharma Beautiful And Cute Girl any...

Transcript: Details of description part II: Describing images in practice - T...

Quality Patents: Patents That Stand the Test of Time

Research Directions for Cross Reality Interfaces

CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity

1. Don’t Make Me Impersonate My Identity Lightning Talk Cynthia Thomas linkedin.com/in/cynthia-thomas, @_techcet_ GKE Security, Google Cloud

2. Kubernetes Pods and their identities - In Kubernetes, Pods are given a distinct identity within a Kubernetes cluster - How? Through a Service Account: typically an account type for non-humans - Pods are always given Service Accounts by default or configured

3. How to get Pods to talk to Cloud Resources Options: 1. Export credentials and mount as a Kubernetes secret in the Pod at runtime 2. Use the worker node/VM identity credential 3. Use Workload Identity Federation

4. Cloud provider K8s Cluster K8s Worker Nodes K8s Worker Nodes K8s Worker Nodes Namespace foo Pod Pod K8s Control Plane kube-API server Workload Identity Federation at work Step 2: Secured communication Cloud IAM Cloud API Step 1: Trust Established Blog: Kubernetes token support for OIDC

5. Before After Create Kubernetes namespace Create Kubernetes namespace Create Kubernetes Service Account (KSA) Create Kubernetes Service Account (KSA) Create Google Service Account Not needed Configure KSA to impersonate GSA Not needed Annotate KSA with the GSA so GKE knows the link Not needed Bind role to Google Service Account (GSA) Bind role directly to KSA SA Impersonation Just say no to impersonation

6. - Dont worry about managing secrets - Dont worry about identity impersonation - Federate identities - supports OIDC/SAML and now X.509 certificates with SPIFFE Don’t make me impersonate my identity Be more secure with Workload Identity Federation!

CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity

More Related Content

Similar to CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity

Similar to CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity (20)

More from Cynthia Thomas

More from Cynthia Thomas (10)

Recently uploaded

Recently uploaded (20)

CNSCon 2024 Lightning Talk: Don’t Make Me Impersonate My Identity