Container Platform Security at Cruise

What built-in “GCP stuff” do you mean? They seem to already be using GKE.

Widespread use of containers is still a pretty new thing. For any company where security is a top priority, it seems likely that their needs will exceed the security features offered by the container infrastructure they are using. In that context it doesn't seem weird to me.

We use as much of built-in gcp stuff as is reasonable but unfortunately there’s no “make things secure” button yet.

Additionally not all gcp components work well with each other as soon as you start using anything beyond google io demo happy case and there’s a lot of missing features still (it’s getting there though). Source: i work on container platform at Cruise

To be fair, the write up isn't much more that.

TL;DR

They use Okta for SSO, GCP for Service Accounts (automation), vault for secrets, ca and tls, GKE generally, and this is how it all works.

That said, the article is good and the author has a good understanding of what's going on. Typically, you need to know how something works before you can form realistic opinion on whether or not it is secure. Too much of the industry is full of blind trust from people that can get things working but don't scratch beyond the surface of integration.

The author has likely had to understand this in order to explain it to InfoSec assurance, compliance and audit departments, but I think writing it down is really useful for people without the tech.

I think they could expand on why they use vault rather than the secrets engine directly, but I suspect that was because of integrations, protability, and the workload indentity functionality behing newer than their setup.