Spotter - Universal Kubernetes Security Engine

A Kubernetes security engineer presents Spotter, an open-source security engine designed to detect vulnerabilities and misconfigurations across modern container platforms [00:02]. The speaker analyzes the multi-layered attack surface of Kubernetes, explaining how risks emerge across decoupled tiers including container supply chains, deployment manifests, and runtime infrastructure [03:56].

The talk details Spotter's architecture, which includes over 140 built-in security rules evaluating platform and runtime controls [07:53]. The speaker demonstrates how Spotter categorizes and prioritizes risks by resource type and severity—focusing scrutiny on high-value targets like Pods, Deployments, and Kubernetes Secrets [11:46]—while integrating continuous scanning routines that synchronize with organizational risk registries during cluster releases [15:42]. The session concludes with a demonstration of mutating admission webhooks, illustrating how Spotter can automatically intercept deployment manifests requesting public Docker Hub images and reroute them to hardened internal private registries [19:30].

(AI summary — Gemini Flash)