KubeSecRay: Fortifying Multi-Tenant Ray Clusters on Kubernetes | Ray Summit 2024
Source: YouTube · Anyscale · published Oct 21, 2024 · 15:53
Securing multi-tenancy in Ray clusters on Kubernetes involves three incremental isolation levels: namespace policies, per-tenant control planes, and virtual machine-level isolation. This approach enables secure, scalable environments for both friendly and hostile multi-tenancy scenarios. 0:46
Key Takeaways:
• Process-level isolation using containers and Kubernetes namespaces with built-in policies (e.g., Gatekeeper, Kerno) 5:02
• Isolating the control plane per tenant using VCluster to create bounded, tenant-specific control planes 8:46
• Achieving full isolation with Virtual CuET, which provisions pods in VMs via cloud providers (e.g., Azure Container Instances) while appearing as standard Kubernetes pods 12:53
This secure, layered model ensures strong tenant boundaries, even in hostile multi-tenancy, without disrupting Kubernetes usability. 15:30
Sources:
- 0:46 Introduction to multi-tenancy security levels and use cases
- 5:02 Process isolation using containers and Kubernetes namespaces with policy engines
- 8:46 VCluster implementation for per-tenant control plane isolation
- 12:53 Virtual CuET enabling VM-level isolation with seamless Kubernetes integration
- 15:30 Summary of layered security model and real-world applicability
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
thank you Kelvin So today we're going to talk about a topic that's not very discussed usually which is securing cubay and running multi-tenancy within a cubay clusters so if you're already using cubra and this is an actual demo here for running executing a CU cluster on kubernetes and this is how long it takes it takes roughly 12 seconds I know it's not very readable but you can see on the right hand side you will have a bunch of containers that are created started and it all happens within 10 12 seconds you would have a ray cluster that's ready to support and handle workloads and if you're wondering how this is happening under the hood this is using the ray operator which a cube Ray operator which is just a piece of software that's used to manage other pieces of software so Cube Ray manag…