Anish Ramasekar
Principal Software Engineer, Microsoft
Seattle, Washington, United States
Actions
Anish Ramasekar is a software engineer at Microsoft, where he works on the Azure Container Upstream team building features for Kubernetes upstream and various CNCF projects that power Azure Kubernetes Service. He is a co-chair of Kubernetes SIG Auth and a maintainer of the Secrets Store CSI Driver project.
Links
Authorized? It Depends.
Refuel those propeller beanie-caps: "it depends" is about to become the Kubernetes API server's favorite answer.
First, Conditional Authorization. Authorizers used to answer only Allow, Deny, or NoOpinion. Now they can say "Allow if..." or "Deny if...", escaping all-or-nothing semantics. Via partial evaluation you can express "create gateways only when class is 'test-gateway'" or "a controller may touch only its own finalizer". We'll trace conditions from authorization into admission, show them in kubectl auth can-i, and explain how CEL lets the API server evaluate them in-process.
Next, a nastier gap: anything on the service network can reach an admission webhook unauthenticated. "IngressNightmare" (CVE-2025-1974) proved it, turning that exposure into RCE and cluster-wide secret theft. Learn how the API server now proves its identity to webhooks by default with API group scoped webhook bound service account tokens.
From Disk to Defense: Kubernetes Admission Policies the API Can't Touch
Imagine this: you've locked down your Kubernetes cluster with admission webhooks and ValidatingAdmissionPolicies. Life is great, until someone runs "kubectl delete validatingwebhookconfiguration" and your entire policy layer vanishes. That's the catch: the thing enforcing your security rules can be deleted by the very API it's supposed to protect. Your policies don't exist during bootstrap either, and they disappear if etcd goes down.
What if you could load those same webhooks and policies from files on disk, active before the API server serves its very first request, and invisible to the REST API? Even better, what if they could protect admission resources themselves, something REST-based policies were never allowed to do?
In this session, we'll show how Manifest-Based Admission Control (k8s.dev/resources/keps/5793) works, live-demo an attacker deleting critical policies and getting stopped cold, and share patterns for shipping tamper-proof configs across your fleet.
Strengthening Kubernetes Trust: SIG Auth's Latest Security Enhancements
SIG Auth is leading efforts to strengthen Kubernetes’ authentication and authorization foundations. This session covers recent and upcoming features shaping security across the stack. Secure image pulls are being enabled using ephemeral ServiceAccount tokens, reducing reliance on long-lived secrets and node-scoped credentials. Kubernetes is gaining a new mechanism for provisioning X.509 certificates directly to pods via the kubelet, enabling strong mTLS authentication and service-to-service communication. Kubelet serving certificate validation is being hardened to prevent node impersonation, especially in dynamic or on-prem environments. In resource management, DRA adds support for privileged admin access to devices in use, enabling secure diagnostics without weakening isolation. We’ll also cover current and future improvements in authorization, such as tighter policy for image pull operations. Join us to learn how these efforts are improving the trust model across Kubernetes.
Secret Guardians: (Secrets Store) CSI Driver and Sync Controller
Applications running on Kubernetes require access to sensitive information (passwords, SSH keys and authentication tokens). But how do you configure your applications when the source of truth for these secrets is an external secret store? What if you need to store, retrieve and perform zero touch rotation of these secrets securely? Meet the (Secrets Store) CSI Driver and Sync Controller, sig-auth subprojects providing a simple way to retrieve secrets from enterprise-grade external stores such as Azure Key Vault, Google Secret Manager and HashiCorp Vault.
In this lightning talk, Anish will introduce you to the (Secrets Store) CSI driver and Sync controller and discuss trade-offs of the CSI driver versus Sync controller.
Rogue No More: Securing Kubernetes with Node-Specific Restrictions
Did you know that a component running across multiple nodes, such as in a daemonset, intended to perform node-specific actions, can pose a significant security risk? If any node the component is running on goes rogue, it can lead to attacks on the cluster, or even worse, a complete takeover of it. What if we could restrict the component's ability to write resources only to those belonging to the node it is running on to prevent such escalation attacks?
In this talk, Anish and James will introduce new Kubernetes security enhancements to bound service account tokens, which can be used with validating admission policies to enforce per-node restrictions on service accounts. This session will provide you with practical implementation guidelines and show you how these enhancements can mitigate risks and protect your infrastructure with robust node isolation.
CEL-Ebrating Simplicity: Mastering Kubernetes Policy Enforcement
As Kubernetes deployments grow increasingly complex, robust policy enforcement is crucial. The Common Expression Language (CEL) provides a powerful solution, enabling the creation of sophisticated, human-readable expressions for Kubernetes policies. This session explores CEL's integration with Kubernetes, simplifying policy definition and enforcement.
Key takeaways:
- Fundamentals of CEL and its Kubernetes integration.
- Practical use cases for CEL in admission control, resource management, and security.
- Enhancing policy expressiveness and flexibility with CEL.
- Introduction to CEL Playground for testing and validating CEL expressions.
Through live demos, learn to leverage CEL and CEL Playground for streamlined policy management in Kubernetes. Ideal for administrators, developers, and DevOps professionals, this session equips you to enhance your Kubernetes policies using CEL.
Join us to discover how CEL and CEL Playground can transform your Kubernetes policy management.
OIDC And Workload Identity In Kubernetes
Traditionally, when applications running in Kubernetes pods need to access public cloud services, they would use service account credentials or other forms of authentication.
Workload identity provides a convenient and secure way to manage access to Cloud (e.g. Google, Azure etc) resources from within Kubernetes by mapping the service account to the associated cloud provider service account. It eliminates the need for managing and distributing individual service account keys or credentials, improving the overall security posture of your applications.
The speakers will walk through the concepts of workload identity on the following lines:
- Explain how OpenID Connect is used to achieve workload identity and the authentication workflow for the same.
- How to set up workload identity on public clouds for managed and unmanaged Kubernetes clusters for public clouds.
- They will also do a demo on how to set up workload identity with an example of Azure/Google public cloud.
Project Lightning Talk + ContribFest + Maintainer Track: KubeCon + CloudNativeCon NA 2026 Sessionize Event Upcoming
KubeCon + CloudNativeCon North America 2026 Sessionize Event Upcoming
KubeCon + CloudNativeCon North America 2024 Sessionize Event
Project Lightning Talk + ContribFest + Maintainer Track: KubeCon + CloudNativeCon North America 2024 Sessionize Event
KubeCon + CloudNativeCon North America 2023 Sessionize Event
Anish Ramasekar
Principal Software Engineer, Microsoft
Seattle, Washington, United States
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top