Platform Engineering Loves Security: Shift Down To Your Platform... Maxime Coquerel & Mathieu Benoit

Platform Engineering Loves Security: Shift Down To Your Platform...

Speakers: Maxime Coquerel, Cloud Security Architect; Mathieu Benoit, Clative Ambassador, Customer Success Engineer at Humanitec

Conference: KubeCon EU

YouTube: https://www.youtube.com/watch?v=Es3DBj2UgIE

Overview

In this insightful KubeCon EU talk, Maxime Coquerel and Mathieu Benoit tackle the perennial challenge of integrating robust security practices within the fast-paced, complex landscape of cloud-native development. They argue that traditional "shift-left" security approaches, which often push security responsibilities onto developers, can lead to friction, slow down innovation, and ultimately reduce developer happiness. Instead, the speakers advocate for a "shift-down" strategy, leveraging Platform Engineering to embed security controls and best practices directly into an Internal Developer Platform (IDP).

The core premise of the talk revolves around transforming security from a perceived blocker to an enabler of innovation, achieved by abstracting complexity and providing developers with secure, standardized "paved roads." Coquerel and Benoit outline a comprehensive framework that combines robust security governance with a product-centric approach to platform development. This methodology aims to empower development teams to build securely by default, without requiring deep security expertise from every individual developer, thereby enhancing both security posture and development velocity.

This discussion is particularly relevant for organizations struggling to balance rapid software delivery with stringent security requirements in Kubernetes and cloud environments. By presenting practical tips, specific tooling, and a strategic shift in mindset, the speakers offer a compelling vision for how platform engineering can become the cornerstone of effective, scalable cloud-native security, fostering a culture where security is seamlessly integrated rather than bolted on.

Background

▶ Watch: Speaker introductions and the complexity of cloud native (0:00)

The journey into cloud-native development, as Mathieu Benoit describes, often begins with a sense of empowerment for developers – from docker run to kubectl run, Helm, and Terraform. However, beneath this apparent simplicity lies a daunting security landscape. Maxime Coquerel highlights the immense complexity, pointing to the sprawling CNCF landscape with its "number of products, the diversity of products," and the inherent challenges in identifying the right tools for specific use cases. This complexity often leads to gaps, overlaps, and a steep learning curve for those not intimately familiar with cloud security.

Traditional security governance, particularly in regulated organizations, typically follows a multi-stage process:

1. Security Review: A technical document outlining the security capabilities of cloud services (e.g., AWS S3), identifying necessary security controls, and potential threats from misconfigurations.
2. Threat Modeling: An early-phase activity mapping architectural components to proactively identify missing security controls or uncovered threats, providing early feedback to developers.
3. Cloud Control Validation: Ensuring adherence to best practices and regulatory standards, often leveraging frameworks like the Cloud Security Alliance Matrix.
4. Pentest: Third-party security assessments, especially for internet-exposed applications, to identify vulnerabilities.

These steps feed into an IT risk scorecard, which defines an application's security posture and is reviewed by a cloud governance board including chief architects and security officers. Without such a framework, scaling security in large, regulated organizations becomes "very, very challenging."

Specific to Kubernetes, the speakers reference the OWASP Top 10 for general application security challenges and the Microsoft Threat Matrix for Kubernetes for specific attack vectors. A significant challenge highlighted is identity in Kubernetes, often suffering from a "lack of identity monitoring."

Despite these established security practices, a critical disconnect emerged: developers felt security was "blocking innovation," limiting their ability to "deliver value for the end user." Surveys revealed developer complaints that security was solely their responsibility, leading to low morale. This friction underscores the need for a new approach that reconciles security imperatives with developer productivity and business velocity. This is where Platform Engineering emerges as a strategic answer, aiming to "shift down to the platform instead of shifting left to the developer."

Key Findings

▶ Watch: Key Kubernetes security challenges and threat matrices (5:00)

The central finding of this talk is the transformative potential of Platform Engineering in addressing the inherent tension between security and developer velocity in cloud-native environments. Rather than burdening developers with the full weight of security responsibility, the speakers propose shifting this burden "down" to a well-designed Internal Developer Platform (IDP). This approach aims to provide developers with a paved road that is secure by default, allowing them to focus on their core application logic while the platform handles the underlying infrastructure and security complexities.

Key findings and contributions include:

• Platform Engineering as the Solution: It acts as a bridge between the complex cloud-native security landscape and the developers' need for simplicity and speed. By drawing on lessons from sysadmin and DevOps, platform engineering focuses on building IDPs that enhance developer experience.
• "Shift Down" Security: This paradigm advocates for embedding security controls, automation, and best practices directly into the platform, abstracting them away from the developer's immediate concerns. This ensures security is consistently applied without requiring developers to be security experts.
• IDP as a Product: A critical insight is to treat the IDP itself as a product with multiple customer personas (developers, security engineers, cloud engineers, network engineers). This necessitates a product manager, a backlog, and a focus on resolving pain points rather than just technical implementation. Security engineers, in particular, need to adopt a product mindset.
• Abstraction and Automation: The talk emphasizes that the IDP's success hinges on its ability to abstract complex infrastructure and security details through tools and frameworks, while automating the enforcement of security policies and checks throughout the software development lifecycle.
• Eight Practical Tips: The speakers distill their recommendations into eight actionable tips, covering aspects from developer productivity tools to advanced security controls and architectural patterns. These tips provide a concrete roadmap for organizations looking to implement a "shift-down" security strategy.
• Early Feedback and Failing Fast: By integrating security checks into the CI pipeline, the platform can provide rapid feedback to developers, allowing them to detect and fix issues much earlier, before deployment, thereby reducing the cost and effort of remediation.
• Keyless Connectivity: The promotion of OIDC-based authentication for workloads accessing cloud resources simplifies credential management, enhances security through short-lived tokens and least privilege, and eliminates the need for manual key rotation.
• Cultural Shift: Ultimately, the talk underscores that security should be viewed as a culture of continuous improvement and collaboration, not just a set of tools or a team that blocks innovation. Embedding security teams within platform engineering teams is presented as a highly successful strategy for fostering this culture.

These findings collectively present a holistic strategy for integrating security seamlessly into cloud-native development, moving beyond the limitations of traditional approaches and fostering a more secure and productive ecosystem.

Technical Deep Dive

▶ Watch: Introducing platform engineering as the solution to complexity (6:00)

The technical deep dive of the talk is structured around empowering both developers and platform/security teams, with a strong emphasis on abstraction, automation, and proactive security measures.

Developer-Focused Enhancements

To simplify developers' lives and keep them in their "inner loop" without being bogged down by infrastructure or security, the speakers propose several key strategies and tools:

1. Abstraction Tools:

• Buildpacks: Abstract away the need for developers to write Dockerfiles, simplifying container image creation.
• Dapr: Provides an abstraction layer for interacting with underlying infrastructure components (e.g., Redis, cloud services), allowing developers to focus on business logic rather than direct API calls.
• Micro-mocking APIs: Enable shifting integration tests left, allowing developers to test locally without needing a full environment, thus accelerating feedback.
• Score: Abstracts deployment details, making it easier for developers to define their application's deployment requirements without deep Kubernetes knowledge.

1. Self-Service and Centralized Documentation:

• Tools like Backstage (and other portal frameworks) are recommended to centralize technical documentation, streamline developer onboarding, and provide a unified view of different systems. This reduces cognitive load by minimizing context switching.

1. Queryable Systems for Enhanced Education:

• Designing systems that allow developers to query status, logs, and reasons for specific behaviors (why this and why not that) can significantly reduce "ticket ops" (e.g., Slack messages, Jira tickets) and empower developers with self-service insights, rather than pushing the cognitive load onto security or Kubernetes engineers.

Platform and Security-Focused Deep Dive (The 4C Security Model)

Maxime Coquerel elaborates on integrating security controls across the CNCF's 4C security model: Code, Container, Cluster, and Cloud.

1. Code Security:

• Infrastructure as Code (IaC) Scanning: Essential for detecting misconfigurations in templates (e.g., Terraform, CloudFormation) early. Tools like Checkov and Kics are specifically mentioned.
• Source Code Scanning: Crucial for identifying vulnerabilities (e.g., CVEs) in dependencies and libraries. This must be done in the early stages of development.

1. Container Security:

• Container Image Scanning: A common practice to identify vulnerabilities within container images.
• Container Image Signing: A critical best practice to ensure only trusted, authorized containers run in the Kubernetes cluster. This can be challenging for large organizations but is vital for supply chain security.
• Distroless Images: Using minimal base images (e.g., from Chainguard) significantly reduces the attack surface by excluding unnecessary components, leading to fewer CVEs and easier maintenance.

1. Cluster Security (Compliance and Misconfiguration Prevention):

• Cloud Vendor Security Controls: Policies applied at the cloud provider level (e.g., Azure Policy, AWS Config, GCP Security Organization Policy). While necessary, these are often "not enough."
• Kubernetes Security Controls: Policies enforced at the cluster level to prevent common misconfigurations, such as running containers as root or with excessive privileges. Recommended solutions include:
• Open Policy Agent (OPA)
• Kyverno
• Gatekeeper
• Pod Security Standards (PSS)
• Gsconfig
• Types of Security Controls:
• Detective: Only informs about incidents. Often the first step but not ideal.
• Preventive: Blocks incidents from happening. The speakers strongly recommend deploying clusters with preventive security controls from day one, as switching from detective to preventive is "very challenging."
• Auto-remediation: Automatically fixes misconfigurations.
• Early Feedback and Education: While cluster-level controls are good, developers are often notified too late (at the cluster gate). Integrating security controls directly into the IDE provides earlier feedback. However, education is key. An AI agent could provide context, best practices, and sample code to help developers resolve misconfigurations without direct security team intervention, addressing the scalability challenge of manual education.
• Advanced Policy Management: For complex use cases and managing exceptions, solutions like Kyverno or OPA Gatekeeper are preferred over simpler PSS.

1. Cloud Security (Runtime Monitoring):

• Runtime Security Monitoring: Beyond static checks, it's crucial to monitor the behavior of workloads within the Kubernetes cluster. This includes detecting anomalous activities like a pod trying to communicate with a malicious botnet or attempting lateral movement (e.g., compromising a node, then moving to the cloud provider to compromise the entire cloud infrastructure).

Shifting Left Detection (Not Responsibility)

The talk emphasizes that while security checks should occur early, the responsibility for understanding and implementing the underlying security tools should remain with the platform team. This is achieved by:

• Templates and Reusable Recipes: Leveraging CI/CD tools like GitLab, GitHub Actions, and Jenkins to create standardized, reusable templates for developers.
• Failing Fast in CI: Integrating security scans (dependency, container, configuration) directly into the Continuous Integration (CI) pipeline. If a check fails, the pipeline stops, providing rapid feedback to the developer before anything is even deployed to a cluster. This is crucial for detecting errors early and reducing remediation costs.

Kubernetes as an Orchestrator, Not a Platform

A crucial architectural insight is that Kubernetes is not a platform; it's something to build a platform upon. The speakers advocate for creating an abstraction layer on top of Kubernetes to orchestrate both Kubernetes and cloud resources. This allows for a more cohesive and developer-friendly experience, hiding the underlying complexities.

Keyless Connectivity

For workloads connecting to cloud provider resources (e.g., a Kubernetes pod connecting to an Azure Cloud SQL database), the recommendation is to implement keyless connectivity using OpenID Connect (OIDC). This mechanism:

• Eliminates the need for long-lived tokens or static credentials within workloads.
• Provides short-lived tokens for authentication.
• Enables role-based access control (RBAC) with the principle of least privilege, enhancing security and simplifying credential rotation challenges.

By combining these technical strategies, organizations can build a robust, developer-friendly IDP that inherently integrates security, shifting the burden of security expertise from individual developers to the platform itself.

Demo / Proof of Concept

▶ Watch: The concept of 'shifting down' to the platform (7:20)

The talk "Platform Engineering Loves Security: Shift Down To Your Platform..." by Maxime Coquerel and Mathieu Benoit does not include a live demonstration or a proof of concept. The speakers utilize architectural diagrams, specific tool mentions, and conceptual workflows to illustrate their points and recommendations throughout the presentation. While the slides show examples of policy definitions (like Pod Security Standards) and how various tools fit into the CI/CD pipeline, these are presented as static illustrations rather than active demonstrations of functionality.

Defensive Implications

▶ Watch: How security experts and platform teams combine forces (8:00)

The insights from this talk offer several critical defensive implications for organizations aiming to strengthen their security posture in cloud-native environments while maintaining developer velocity. The core message is to embrace Platform Engineering as the primary vehicle for delivering secure-by-default infrastructure.

1. Adopt a "Shift Down" Security Strategy: Defenders should actively work to embed security controls, policies, and best practices directly into the Internal Developer Platform (IDP). This means abstracting security complexity away from individual developers and making security an inherent part of the platform's functionality, rather than an add-on.

1. Prioritize Preventive Security Controls: When deploying Kubernetes clusters and defining policies, defenders should aim for preventive security controls from day one. Retrofitting preventive measures after starting with detective-only controls is significantly more challenging and disruptive. This includes using policy engines like OPA Gatekeeper, Kyverno, or Pod Security Standards (PSS) to block insecure configurations (e.g., root containers, excessive privileges) at the cluster admission level.

1. Integrate Security Early and Automatically into CI/CD: Implement automated Infrastructure as Code (IaC) scanning (e.g., Checkov, Kics) and source code scanning in the CI pipeline. Crucially, integrate container image scanning and ensure pipelines "fail fast" if security vulnerabilities or misconfigurations are detected. This provides immediate feedback to developers, reducing the cost and effort of fixing issues later in the development lifecycle.

1. Mandate Container Image Signing and Distroless Images: To combat software supply chain attacks, enforce container image signing to ensure only trusted images run in production. Additionally, encourage or mandate the use of distroless images (e.g., from Chainguard) to significantly reduce the attack surface and the number of vulnerabilities requiring maintenance.

1. Implement Comprehensive Runtime Security Monitoring: Beyond static analysis and admission controls, defenders must deploy solutions for runtime security monitoring within Kubernetes clusters. This enables detection of suspicious behaviors such as lateral movement attempts, communication with malicious external entities, or unauthorized process execution, providing critical visibility into active threats.

1. Centralize Developer Experience with Self-Service Portals: Leverage tools like Backstage to create a centralized portal for developers, offering streamlined access to documentation, onboarding processes, and system status. This reduces cognitive load on developers and frees up security/platform teams from answering repetitive queries, allowing them to focus on more strategic tasks.

1. Embrace Keyless Connectivity with OIDC: For workload access to cloud provider resources, transition away from long-lived credentials to OpenID Connect (OIDC)-based authentication. This provides short-lived tokens, enforces least privilege, and simplifies credential management by eliminating the need for manual key rotation, significantly reducing the risk of compromised credentials.

1. Foster a Product Mindset for the IDP: Treat the Internal Developer Platform as a product with security as a core feature. This involves having a product manager, a backlog, and continuously iterating based on user feedback (developers, operations, security). This ensures security features are developed with user experience in mind, increasing adoption and effectiveness.

1. Embed Security Engineers within Platform Teams: To break down silos and foster a security-first culture, security teams should be embedded directly within platform engineering teams. This encourages collaboration from day one, improves communication, and ensures security considerations are integrated organically into platform design and development, rather than being an afterthought.

By adopting these defensive strategies, organizations can build a robust, resilient, and developer-friendly cloud-native environment where security is a fundamental enabler of innovation, rather than a barrier.

Key Takeaways

• Shift Security Down to the Platform: Instead of solely "shifting left" to developers, embed security controls and best practices directly into a well-designed Internal Developer Platform (IDP), making security an inherent, abstracted capability.
• Treat the IDP as a Product: Approach the Internal Developer Platform with a product mindset, focusing on developer experience, resolving pain points, and having a dedicated product owner and backlog to ensure continuous improvement and adoption.
• Proactive and Preventive Controls are Key: Prioritize deploying preventive security controls (e.g., OPA Gatekeeper, Kyverno) from the outset in Kubernetes clusters to block misconfigurations, and integrate automated security checks early in the CI pipeline for rapid feedback.
• Embrace Abstraction and Automation: Leverage tools like Buildpacks, Dapr, and Backstage to abstract away infrastructure and security complexities from developers, while automating security scanning (IaC, code, container) and policy enforcement throughout the development lifecycle.
• Secure the Software Supply Chain: Implement critical practices like container image signing and utilize distroless images to minimize the attack surface and ensure the integrity and trustworthiness of deployed workloads.
• Foster Cross-Functional Collaboration: Embed security engineers directly into platform engineering teams to break down silos, improve communication, and ensure security is integrated from design to deployment, building a security-first culture.

About the Speaker(s)

Mathieu Benoit is a Clative ambassador and a Customer Success Engineer at Humanitec. His background as an app developer transitioning into platform engineering provides him with a deep understanding of the challenges developers face and the value that platform engineering can bring to improve their experience.

Maxime Coquerel is a Cloud Security Architect. His expertise lies in navigating the complex security landscape of cloud-native environments, designing robust security frameworks, and identifying effective tooling and strategies to protect modern infrastructures. His disclaimer emphasizes that the opinions expressed are his own.