Kubernetes gives you powerful primitives to enforce least-privilege—NetworkPolicies, Seccomp, PodSecurity—but most teams don’t use them effectively. Why? Because they’re hard to write, harder to maintain, and nearly impossible to get right without deep understanding of workload behavior. This talk explores a better approach: using eBPF to observe real runtime behavior—like syscall activity and network connections—and automatically generate policies from that data.

We’ll cover: - The challenge: why most Kubernetes workloads are over-privileged and how manual policy writing slows security adoption - The shift in mindset: from static “deny-all + guess-allow” to dynamic “observe + generate” - How eBPF helps: watching syscalls, tracking pod traffic, and surfacing actionable insights with minimal performance impact - Practical workflows: how platform and security teams can observe workloads in dev/staging, generate policies, and enforce least privilege safely - Real-world outcomes: faster onboarding, reduced blast radius, and audit-ready security posture with less manual effort

This isn’t about selling a tool. It’s about changing how we think about security in Kubernetes—and giving teams the observability and automation needed to make it real. Attendees will leave with an understanding of: - What eBPF brings to Kubernetes security - How to apply runtime data to policy generation - Why this approach aligns with compliance, platform scalability, and DevSecOps best practices