Tomas Vitvar
Software Engineer and Lecturer
Prague, Czechia
Actions
Tomas Vitvar is an Associate Professor at the Czech Technical University in Prague and a technology leader with over 20 years of experience in software engineering, DevOps, and cloud-native infrastructure. He collaborates with organizations such as Vodafone UK, IKEA, and Volvo on designing and operating Kubernetes-based and service-oriented platforms. His work spans full-stack development, infrastructure design, troubleshooting, and performance tuning. Tomas has contributed to numerous research and development projects in service-oriented computing and web engineering and has published over 40 papers in international venues such as IEEE Internet Computing and IEEE Software. He co-authored a book on Web and SOA technologies for e-government and has co-organized several research events, including the AAAI Spring Symposium at Stanford University. Tomas holds a Ph.D. in Computer Science from the Czech Technical University in Prague and combines academic research with practical experience in large-scale system design and operations.
Area of Expertise
Topics
One Policy Engine, Many Protocols: Unifying Authorization Across SSH, gRPC, and Kubernetes with OPA
Access control in a multi-tenant platform gets messy fast when every service that needs to make a decision ends up with its own rules for making it: one set of rules for SSH access, another for the API, a third for who gets a Kubernetes service account token.
In k8shell, we consolidated all of this into a single OPA/Rego policy service, called over gRPC from every component that needs an authorization decision: SSH authentication, our identity gRPC API, on-demand Kubernetes TokenRequest issuance, and personal access token scoping.
We'll walk through how a single external policy point handles fundamentally different actions and protocols through one consistent scope grammar (domain:action:qualifier:constraint) from coarse decisions like "can this user onboard at all" to fine-grained ones like "can this token read this user's own profile, but nobody else's." We'll cover how onboarding policy evaluation attaches obligations (sudo, roles, blueprints) to a new identity at first login, how personal access tokens get scoped and constrained down from a user's full policy at issuance time, and the tradeoffs of centralizing authz versus letting each service own its own checks.
Worktrace: Real-Time Threat Detection for Kubernetes Workspaces Using eBPF
Most developer tooling treats Kubernetes as a deployment target for application workloads - but what if it became the development environment itself? Running interactive workspaces natively on Kubernetes offers compelling advantages: developers work in environments that mirror production, teams share cluster resources more efficiently, and ephemeral workspaces can be spun up and torn down on demand. This is the vision driving k8shell, our Kubernetes-native workspace project.
But as these environments mature, they introduce a security challenge the ecosystem has yet to fully address. Interactive workspaces are long-lived and user-driven, and they often require elevated privileges by design - making them a high-value target once an attacker gains access to the cluster. Traditional perimeter security offers little protection at this layer.
This session introduces Worktrace, a real-time threat detection system we built to address exactly this gap. Worktrace uses eBPF-based kernel observability to identify malicious activity inside live Kubernetes workspaces. It combines three detection strategies: rule-based matching for known attack signatures, multi-step attack path correlation, and behavioral anomaly detection. Detection rules are defined declaratively in YAML, capturing both the detection logic and the instrumentation scope in one place. The system deploys as a Kubernetes DaemonSet alongside Cilium Tetragon and integrates natively into standard monitoring infrastructure.
We'll walk through controlled penetration testing results across ten distinct attack techniques, including container escapes via privileged mode, kernel module injection, ptrace-based process injection, and Kubernetes-level privilege escalation. They were all successfully detected at under 3% node CPU overhead and less than 14 MiB of memory per node.
Turning Kubernetes into a Developer Platform: Lessons from 300 Student Workspaces
Running hands-on courses for hundreds of students used to be an endless pain - local installs, misconfigured laptops, and lab PCs without sudo rights. To fix this, we built K8shell, a Kubernetes-native platform that provisions isolated workspaces as pods, and with course-specific images. Students connect through our secure SSH proxy, seamlessly just using VS Code, IntelliJ, or SSH CLI.
Deployed in a university datacenter, K8shell serves 300+ workspaces each semester. Similar in spirit to GitHub Codespaces, it brings the same developer experience to self-hosted, controlled environments. We’ll share how we built a secure multi-tenant setup with RBAC and network policies, on-demand workspace provisioning, and managed diverse course workloads: from CPU-intensive ML labs to I/O-bound system exercises. Although we developed K8shell to improve our teaching experience, the same architecture can power any development workload - flexible, secure, and accessible from any IDE.
KCD Porto x DevOps Days Portugal 2026 Sessionize Event Upcoming
Dutch Cloud Native Day 2026 Sessionize Event Upcoming
KCD UK Edinburgh 2026 Sessionize Event Upcoming
Cloud Native Summit 2026 Sessionize Event
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top