Uploaded August 2026 | Updated September 2026, 2 weeks ago
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
Who's Using That GPU? Identity-Aware Access Control for Kubernetes GPU Workloads - Peter ONeill, Teleport & Kunal Kushwaha, Cast AI
Who requested that GPU, why do they have it, and when will they give it back? In most clusters running DRA, nobody knows. Any user with basic RBAC can claim a GPU with no identity verification, no justification, and no expiry.
This talk fixes that. The speaker demos an open-source validating admission webhook that intercepts DRA ResourceClaim creation and enforces identity-aware policy: human authentication via Dex, group-based device class authorization, mandatory justification, team budget enforcement, and time-based constraints. SPIRE issues workload SVIDs to create a cryptographic identity chain from human to GPU device. A TTL controller automatically reclaims GPUs when sessions expire.
The live demo walks through five denial scenarios and a full approval-to-cleanup lifecycle using only CNCF-aligned tooling. Attendees leave with a deployable architecture and open-source repo.
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
Who's Using That GPU? Identity-Aware Access Control for Kubernetes GPU Workloads - Peter ONeill, Teleport & Kunal Kushwaha, Cast AI
Who requested that GPU, why do they have it, and when will they give it back? In most clusters running DRA, nobody knows. Any user with basic RBAC can claim a GPU with no identity verification, no justification, and no expiry.
This talk fixes that. The speaker demos an open-source validating admission webhook that intercepts DRA ResourceClaim creation and enforces identity-aware policy: human authentication via Dex, group-based device class authorization, mandatory justification, team budget enforcement, and time-based constraints. SPIRE issues workload SVIDs to create a cryptographic identity chain from human to GPU device. A TTL controller automatically reclaims GPUs when sessions expire.
The live demo walks through five denial scenarios and a full approval-to-cleanup lifecycle using only CNCF-aligned tooling. Attendees leave with a deployable architecture and open-source repo.
