Securing Cloud-Native Workloads from the Metal Up

Learn how to secure cloud-native workloads running on bare-metal infrastructure by establishing hardware-rooted trust using TPMs (Trusted Platform Modules) in this 28-minute conference talk from KubeCon + CloudNativeCon. Explore the security challenges that arise when companies repatriate expensive workloads from public cloud to on-premises physical servers, and discover how this differs from traditional cloud security models. Understand the fundamentals of SPIRE and SPIFFE frameworks, then dive deep into implementing application identity chains that trace back to the underlying hardware for enhanced security. Examine how to leverage TPMs onboard physical servers to create a robust foundation of trust for Kubernetes workloads. Compare bare-metal security approaches with virtual TPM (vTPM) offerings from cloud providers, and learn to design a unified machine-identity architecture that works consistently across both cloud and datacenter environments. Gain practical insights into the planning and implementation considerations necessary for securing physical infrastructure while maintaining the flexibility and scalability of cloud-native applications.