Tremolo Security

PostgreSQL as a Service, without database passwords. CloudNativePG manages the databases; OpenUnison exchanges Kubernetes workload identity for short-lived tokens that PostgreSQL 18 validates via OAuth. www.tremolo.io/post/postgre...

OpenUnison 1.0.51 Release. Maintenance release, updated dependencies for OpenUnison, the operator and kube-oidc-proxy. github.com/TremoloSecur...

It's been 2 years since we released the third edition. It's now $30 on Amazon and is still one of the top selling kubernetes books. If you haven't picked it up yet, you should take a look. It will get you through most enterprise focussed topics with labs that we recorded videos for you can follow.

OpenUnison 1.0.50 has been released! This is a small release but the operator now handles all webhooks, eliminating issues with conflicts when deploying with Helm. Also, proper ownerReferences make Argo CD work better for deployment too! github.com/TremoloSecur...

New OpenUnison! 1.0.49. Includes some more updates for the STS, and flexibility for JWT authentication. Also cleaned up some dependencies. github.com/TremoloSecur...

Good morning KCD Toronto!!!!

Just added a new app's RESTful API for user management for a customer. Using our new testing harness we went from zero to production in less then a week. Tested everything offline, then quick rollout. Even integrated short lived tokens, so no API keys!

New release of OpenUnison! We've made it even easier to quickly rotate keys for your STS. github.com/TremoloSecur...

You kube cluster is on-prem, the api is in the cloud. How do you securely connect? I'll show you how at KCD Toronto! We'll step through how to design a Pod identity that can withstand an attack in the AI age. Hope to see you there! kcdtoronto.ca

OpenUnison 1.0.46 is now available! Small release to fix a couple of bugs. github.com/TremoloSecur...

OpenUnison 1.0.45 has been released! The latest version now supports hot update of keys, so your identity providers can rotate keys automatically without restarts. github.com/TremoloSecur...

We've sponsored this great podcast, and you should too!

We've updated kube-oidc-proxy. No new features, but have cut known CVEs for the code base to 0! Updated libraries and removed deprecated ones. Integrated into the OpenUnison helm charts. github.com/TremoloSecur...

This release brings native Headlamp integration, expanded OIDC capabilities, and a new SCIM 2.0 gateway. If you care about Kubernetes identity done right, take a look 👇 www.tremolo.io/post/openuni...

We're going to have a @headlamp.dev plugin for OpenUnison that adds namespace limiting based on an API and a "who am i" page so you can see you ask kubernetes sees you. We're also going to add some other operational support tasks that are common too.

Just finished rewriting Openunison 's Traefik support. Moving forward, Traefik will likely be my go-to Ingress controller. Gateway API support added too but with lack of consistent re-encryption support and no standard for sticky sessions I don't recommend it yet.

This is an appreciation post for people who provide detailed GitHub issues.

Authenticate Kubernetes workloads to HashiCorp Vault using JWT/OIDC and short-lived tokens—no static ServiceAccount credentials. #Kubernetes #Vault #OIDC #WorkloadIdentity www.tremolo.io/post/short-l...

Um, no, um, but, I...think I hear my mom calling...

Hmmm....bit of nostalgia marketing....

It would be pretty cool if you, I dunno, tossed kube on their and then set it up to securely talk to cloud based systems without any static keys...

Rewrote the websockets layer to be simpler, now Head Lamp with impersonation is working great for logs and terminals! Next release will default to Head Lamp instead of the Kubernetes dashboard. Will also remove the need for a second chart.

It'll be OK Marc....

We deployed Istio...now what? Does it work? Can my app run? How do I know the mesh is running? Join us at noon EST to find out! youtube.com/live/hMFX7EI...

We've released OpenUnison 1.0.43! We've made building Security Token Services easier, simplified kubernetes logins with a new kubectl plugin, and made privileged access to Kubernetes a snap. Check out our new features with more blog posts coming soon! www.tremolo.io/post/openuni...

Trick or treat, smell my skeet, give me a great service mesh. If you don't, I don't care, I'll pull out your token there! OK, know it doesn't all rhyme but let's learn how to deploy Istio!

Are you also at #kcddc? Come find me and say hi!

Your Pods, they're talking to you....can you hear them? We'll walk through how Kubernetes manages your logs using OpenSearch. youtube.com/live/VeArPBy...

No, also, no one likes old pictures of them being posted on socials without their permission!!!!!

A customer did an accessibility review of OpenUnison's UI. Try hard to get it right, don't pretend to always do and was pretty happy at how well the report came back. Been in the weeds the last couple of days getting the few issues they found corrected.

Backups and disaster recovery is so hot we couldn't keep it in just one live stream! We'll wrap up our chapter on backups today at noon EST! youtube.com/live/ibE6I5_...

This was @tremolo.io first conference booth. Red Hat Summit 2015. We were talking about applications and OpenShift and almost everyone we talked to was asking about Satellite🤣🤣🤣. This was our official exit from "stealth".

In a stream that's too hot for TV....the sexiest topic in all of enterprise infrastructure...BACKUPS!!!! Join us at noon for deep dive on our backups chapter with Velero! youtube.com/live/yByl5Zm...

For TBT, how can you use your Kubernetes ServiceAccount tokens to access AWS services? www.tremolo.io/post/securel...

Packt is giving Kubernetes: An Enterprise Guide, 3rd Ed away for $38US. Get the paperback, you get the PDF for free. Kube, auth, networking, monitoring, vCluster, Vault, Istio, Pulumi, and more! a.co/d/7dwcw20

One more vCluster lab! We're wrapping up the chapter building a self service portal for vCluster deployment, integrating our vClusters with Vault for secrets management and our enterprise authentication. Hope to see you there! youtube.com/live/udRnQWd...

If you're using OpenUnison, we're looking for help testing out our new kubectl authentication plugin! Any feedback would be greatly appreciated! www.reddit.com/r/kubernetes...

🚨In thirty minutes let's talk vClusters!🚨 youtube.com/live/QDOU1Jd...

Anyone want to test it out? kubernetes krew install --manifest-url=https://nexus.tremolo.io/repository/openunison-cli-betas/openunison-cli.yaml

This is going to make accessing clusters even easier!

Did you know RBAC isn't just a source a existential dread, fear, and loathing? It's also the first line of authorization in Kubernetes! Join us tomorrow (3/26) at noon EST to dive into RBAC policy management and policy logs! youtube.com/live/Whu5KmO...

With Android's new terminal i'm logged into my clusters using kubectl securely using OpenUnison on my phone. No config files, no certs, no long lived tokens. MFA with passkeys.

Today's coffeeshop project: when we update @tremolo.io helm charts, we now generate a json doc with latest versions and publish. Then we automatically update our argocd template so it's always got the latest versions so you don't need to manually check them!

Next Wednesday, we talk about something near, and dear, to my ❤️, authentication! Come join and hang out! youtube.com/live/Pl93-Xy...

Let's get OpenShift Namespace as a Service working with EntraID! Recording for a blog post, come hang out! youtube.com/live/g6q3Ltl...

Most enterprises need high availability across multiple data centers. Usually in different regions. How does that work? We'll talk about that tomorrow at noon est! youtube.com/live/TbURZ3W...

(in my Darth Vader voice) My lab is complete, I will never again have to enter a password to access the systems in my lab!