8 ms·

It seems weird to me that a self-driving car company is doing work on core server infrastructure things like container security. Does the builtin GCP stuff real

It seems weird to me that a self-driving car company is doing work on core server infrastructure things like container security. Does the builtin GCP stuff really not work for them? My impression has been that it’s really well thought-out.

zapita 7y ago
What built-in “GCP stuff” do you mean? They seem to already be using GKE.
PopeDotNinja 7y ago
Widespread use of containers is still a pretty new thing. For any company where security is a top priority, it seems likely that their needs will exceed the security features offered by the container infrastructure they are using. In that context it doesn't seem weird to me.
dilyevsky 7y ago
We use as much of built-in gcp stuff as is reasonable but unfortunately there’s no “make things secure” button yet. Additionally not all gcp components work well with each other as soon as you start using anything beyond google io demo happy case and there’s a lot of missing features still (it’s getting there though). Source: i work on container platform at Cruise
ownagefool 7y ago
To be fair, the write up isn't much more that. TL;DR They use Okta for SSO, GCP for Service Accounts (automation), vault for secrets, ca and tls, GKE generally, and this is how it all works. That said, the article is good and the author has a good understanding of what's going on. Typically, you need to know how something works before you can form realistic opinion on whether or not it is secure. Too much of the industry is full of blind trust from people that can get things working but don't scratch beyond the surface of integration. The author has likely had to understand this in order to explain it to InfoSec assurance, compliance and audit departments, but I think writing it down is really useful for people without the tech. I think they could expand on why they use vault rather than the secrets engine directly, but I suspect that was because of integrations, protability, and the workload indentity functionality behing newer than their setup.
- techslave 7y ago
  > I think writing it down is really useful for people without the tech. writing it down, sure. but publishing it is useful for SEO and recruitment purposes.
- tbfrench 7y ago
  disclaimer: I work at Cruise >The author has likely had to understand this in order to explain it to InfoSec... Even better: Mike Ruth, one of the co-authors, is in the Security team. >I think they could expand on why they use vault rather than the secrets engine directly Watch this space...

zapita 7y ago

What built-in “GCP stuff” do you mean? They seem to already be using GKE.

PopeDotNinja 7y ago

Widespread use of containers is still a pretty new thing. For any company where security is a top priority, it seems likely that their needs will exceed the security features offered by the container infrastructure they are using. In that context it doesn't seem weird to me.

dilyevsky 7y ago

We use as much of built-in gcp stuff as is reasonable but unfortunately there’s no “make things secure” button yet. Additionally not all gcp components work well with each other as soon as you start using anything beyond google io demo happy case and there’s a lot of missing features still (it’s getting there though). Source: i work on container platform at Cruise

ownagefool 7y ago

To be fair, the write up isn't much more that. TL;DR They use Okta for SSO, GCP for Service Accounts (automation), vault for secrets, ca and tls, GKE generally, and this is how it all works. That said, the article is good and the author has a good understanding of what's going on. Typically, you need to know how something works before you can form realistic opinion on whether or not it is secure. Too much of the industry is full of blind trust from people that can get things working but don't scratch beyond the surface of integration. The author has likely had to understand this in order to explain it to InfoSec assurance, compliance and audit departments, but I think writing it down is really useful for people without the tech. I think they could expand on why they use vault rather than the secrets engine directly, but I suspect that was because of integrations, protability, and the workload indentity functionality behing newer than their setup.

techslave 7y ago
> I think writing it down is really useful for people without the tech. writing it down, sure. but publishing it is useful for SEO and recruitment purposes.
tbfrench 7y ago
disclaimer: I work at Cruise >The author has likely had to understand this in order to explain it to InfoSec... Even better: Mike Ruth, one of the co-authors, is in the Security team. >I think they could expand on why they use vault rather than the secrets engine directly Watch this space...