Security
129 briefings in the desk
Kubernetes 1.26: Non-Graceful Node Shutdown Moves to Beta
Kubernetes v1.24 introduced an alpha quality implementation of improvements for handling a non-graceful node shutdown. In Kubernetes v1.26, this feature moves to beta. This feature allows stateful workloads to failover to a different node…
Finding suspicious syscalls with the seccomp notifier
Debugging software in production is one of the biggest challenges we have to face in our containerized environments. Being able to understand the impact of the available security options, especially when it comes to configuring our…
Kubernetes Removals, Deprecations, and Major Changes in 1.26
Change is an integral part of the Kubernetes life-cycle: as Kubernetes grows and matures, features may be deprecated, removed, or replaced with improvements for the health of the project. For Kubernetes v1.26 there are several planned:…
Current State: 2019 Third Party Security Audit of Kubernetes
We expect the brand new Third Party Security Audit of Kubernetes will be published later this month (Oct 2022). In preparation for that, let's look at the state of findings that were made public as part of the last third party security…
Announcing the Auto-refreshing Official Kubernetes CVE Feed
A long-standing request from the Kubernetes community has been to have a programmatic way for end users to keep track of Kubernetes security issues (also called "CVEs", after the database that tracks public security issues across different…
Kubernetes 1.25: KMS V2 Improvements
With Kubernetes v1.25, SIG Auth is introducing a new v2alpha1 version of the Key Management Service (KMS) API. There are a lot of improvements in the works, and we're excited to be able to start down the path of a new and improved KMS!…
Kubernetes v1.25: Pod Security Admission Controller in Stable
The release of Kubernetes v1.25 marks a major milestone for Kubernetes out-of-the-box pod security controls: Pod Security admission (PSA) graduated to stable, and Pod Security Policy (PSP) has been removed. PSP was deprecated in Kubernetes…
PodSecurityPolicy: The Historical Context
The PodSecurityPolicy (PSP) admission controller has been removed, as of Kubernetes v1.25. Its deprecation was announced and detailed in the blog post PodSecurityPolicy Deprecation: Past, Present, and Future, published for the Kubernetes…
Kubernetes v1.25: Combiner
Announcing the release of Kubernetes v1.25! This release includes a total of 40 enhancements. Fifteen of those enhancements are entering Alpha, ten are graduating to Beta, and thirteen are graduating to Stable. We also have two features…
Kubernetes Removals and Major Changes In 1.25
As Kubernetes grows and matures, features may be deprecated, removed, or replaced with improvements for the health of the project. Kubernetes v1.25 includes several major changes and one major removal. The Kubernetes API Removal and…
Kubernetes Gateway API Graduates to Beta
We are excited to announce the v0.5.0 release of Gateway API. For the first time, several of our most important Gateway API resources are graduating to beta. Additionally, we are starting a new initiative to explore how Gateway API can be…
Kubernetes 1.24: Maximum Unavailable Replicas for StatefulSet
Kubernetes StatefulSets, since their introduction in 1.5 and becoming stable in 1.9, have been widely used to run stateful applications. They provide stable pod identity, persistent per pod storage and ordered graceful deployment, scaling…
Kubernetes 1.24: Prevent unauthorised volume mode conversion
Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a PersistentVolumeClaim created from an existing VolumeSnapshot in the Kubernetes cluster. The problem The Volume Mode…
Kubernetes 1.24: Stargazer
We are excited to announce the release of Kubernetes 1.24, the first release of 2022! This release consists of 46 enhancements: fourteen enhancements have graduated to stable, fifteen enhancements are moving to beta, and thirteen…
Increasing the security bar in Ingress-NGINX v1.2.0
The Ingress may be one of the most targeted components of Kubernetes. An Ingress typically defines an HTTP reverse proxy, exposed to the Internet, containing multiple websites, and with some privileged access to Kubernetes API (such as to…
Is Your Cluster Ready for v1.24?
Way back in December of 2020, Kubernetes announced the deprecation of Dockershim. In Kubernetes, dockershim is a software shim that allows you to use the entire Docker engine as your container runtime within Kubernetes. In the upcoming…
Securing Admission Controllers
Admission control is a key part of Kubernetes security, alongside authentication and authorization. Webhook admission controllers are extensively used to help improve the security of Kubernetes clusters in a variety of ways including…
Kubernetes is Moving on From Dockershim: Commitments and Next Steps
Kubernetes is removing dockershim in the upcoming v1.24 release. We're excited to reaffirm our community values by supporting open source container runtimes, enabling a smaller kubelet, and increasing engineering velocity for teams using…
What's new in Security Profiles Operator v0.4.0
The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement to make the management of seccomp, SELinux and AppArmor profiles easier and more convenient. We're happy to announce that we recently released v0.4.0 of the…
Kubernetes 1.23: StatefulSet PVC Auto-Deletion (alpha)
Kubernetes v1.23 introduced a new, alpha-level policy for StatefulSets that controls the lifetime of PersistentVolumeClaims (PVCs) generated from the StatefulSet spec template for cases when they should be deleted automatically when the…
Kubernetes 1.23: Prevent PersistentVolume leaks when deleting out of order
PersistentVolume (or PVs for short) are associated with Reclaim Policy. The Reclaim Policy is used to determine the actions that need to be taken by the storage backend on deletion of the PV. Where the reclaim policy is Delete, the…
Kubernetes 1.23: Pod Security Graduates to Beta
With the release of Kubernetes v1.23, Pod Security admission has now entered beta. Pod Security is a built-in admission controller that evaluates pod specifications against a predefined set of Pod Security Standards and determines whether…
Kubernetes 1.23: The Next Frontier
We’re pleased to announce the release of Kubernetes 1.23, the last release of 2021! This release consists of 47 enhancements: 11 enhancements have graduated to stable, 17 enhancements are moving to beta, and 19 enhancements are entering…
Dockershim removal is coming. Are you ready?
Reviewers: Davanum Srinivas, Elana Hashman, Noah Kantrowitz, Rey Lejano. This poll closed on January 7, 2022. Last year we announced that Kubernetes' dockershim component (which provides a built-in integration for Docker Engine) is…