Security
129 briefings in the desk
Non-root Containers And Devices
The user/group ID related security settings in Pod's securityContext trigger a problem when users want to deploy containers that use accelerator devices (via Kubernetes Device Plugins) on Linux. In this blog post I talk about the problem…
A Closer Look at NSA/CISA Kubernetes Hardening Guidance
The open source tools listed in this article are to serve as examples only and are in no way a direct recommendation from the Kubernetes community or authors. Background USA's National Security Agency (NSA) and the Cybersecurity and…
Spotlight on SIG Node
Introduction In Kubernetes, a Node is a representation of a single machine in your cluster. SIG Node owns that very important Node component and supports various subprojects such as Kubelet, Container Runtime Interface (CRI) and more to…
Enable seccomp for all workloads with a new v1.22 alpha feature
This blog post is about a new Kubernetes feature introduced in v1.22, which adds an additional security layer on top of the existing seccomp support. Seccomp is a security mechanism for Linux processes to filter system calls (syscalls)…
Kubernetes 1.22: Server Side Apply moves to GA
Server-side Apply (SSA) has been promoted to GA in the Kubernetes v1.22 release. The GA milestone means you can depend on the feature and its API, without fear of future backwards-incompatible changes. GA features are protected by the…
Updating NGINX-Ingress to use the stable Ingress API
With all Kubernetes APIs, there is a process to creating, maintaining, and ultimately deprecating them once they become GA. The networking.k8s.io API group is no different. The upcoming Kubernetes 1.22 release will remove several…
Kubernetes Release Cadence Change: Here’s What You Need To Know
On April 23, 2021, the Release Team merged a Kubernetes Enhancement Proposal (KEP) changing the Kubernetes release cycle from four releases a year (once a quarter) to three releases a year. This blog post provides a high level overview…
Spotlight on SIG Usability
SIG Usability, which is featured in this Spotlight blog, has been deprecated and is no longer active. As a result, the links and information provided in this blog post may no longer be valid or relevant. Should there be renewed interest…
Kubernetes API and Feature Removals In 1.22: Here’s What You Need To Know
As the Kubernetes API evolves, APIs are periodically reorganized or upgraded. When APIs evolve, the old APIs they replace are deprecated, and eventually removed. See Kubernetes API removals to read more about Kubernetes' policy on removing…
Using Finalizers to Control Deletion
Deleting objects in Kubernetes can be challenging. You may think you’ve deleted something, only to find it still persists. While issuing a kubectl delete command and hoping for the best might work for day-to-day operations, understanding…
Graceful Node Shutdown Goes Beta
Graceful node shutdown, beta in 1.21, enables kubelet to gracefully evict pods during a node shutdown. Kubernetes is a distributed system and as such we need to be prepared for inevitable failures — nodes will fail, containers might crash…
Defining Network Policy Conformance for Container Network Interface (CNI) providers
Special thanks to Tim Hockin and Bowie Du (Google), Dan Winship and Antonio Ojea (Red Hat), Casey Davenport and Shaun Crampton (Tigera), and Abhishek Raut and Antonin Bas (VMware) for being supportive of this work, and working with us to…
Kubernetes 1.21: CronJob Reaches GA
In Kubernetes v1.21, the CronJob resource reached general availability (GA). We've also substantially improved the performance of CronJobs since Kubernetes v1.19, by implementing a new controller. In Kubernetes v1.20 we launched a revised…
PodSecurityPolicy Deprecation: Past, Present, and Future
Update: With the release of Kubernetes v1.25, PodSecurityPolicy has been removed. You can read more information about the removal of PodSecurityPolicy in the Kubernetes 1.25 release notes. PodSecurityPolicy (PSP) is being deprecated in…
Kubernetes 1.20: Pod Impersonation and Short-lived Volumes in CSI Drivers
Typically when a CSI driver mounts credentials such as secrets and certificates, it has to authenticate against storage providers to access the credentials. However, the access to those credentials are controlled on the basis of the pods'…
Kubernetes 1.20: Granular Control of Volume Permission Changes
Kubernetes 1.20 brings two important beta features, allowing Kubernetes admins and users alike to have more adequate control over how volume permissions are applied when a volume is mounted inside a Pod. Allow users to skip recursive…
Cloud native security for your clusters
Over the last few years a small, security focused community has been working diligently to deepen our understanding of security, given the evolving cloud native infrastructure and corresponding iterative deployment practices. To enable…
Introducing Hierarchical Namespaces
Safely hosting large numbers of users on a single Kubernetes cluster has always been a troublesome task. One key reason for this is that different organizations use Kubernetes in different ways, and so no one tenancy model is likely to…
How Docs Handle Third Party and Dual Sourced Content
Editor's note: Zach is one of the chairs for the Kubernetes documentation special interest group (SIG Docs). Late last summer, SIG Docs started a community conversation about third party content in Kubernetes docs. This conversation became…
Kong Ingress Controller and Service Mesh: Setting up Ingress to Istio on Kubernetes
Kubernetes has become the de facto way to orchestrate containers and the services within services. But how do we give services outside our cluster access to what is within? Kubernetes comes with the Ingress API object that manages external…
Deploying External OpenStack Cloud Provider with Kubeadm
This document describes how to install a single control-plane Kubernetes cluster v1.15 with kubeadm on CentOS, and then deploy an external OpenStack cloud provider and Cinder CSI plugin to use Cinder volumes as persistent volumes in…
Announcing the Kubernetes bug bounty program
Authors: Maya Kaczorowski and Tim Allclair, Google, on behalf of the Kubernetes Product Security Committee Today, the Kubernetes Product Security Committee is launching a new bug bounty program, funded by the CNCF, to reward researchers…
Kubernetes 1.17 Feature: Kubernetes Volume Snapshot Moves to Beta
The Kubernetes Volume Snapshot feature is now beta in Kubernetes v1.17. It was introduced as alpha in Kubernetes v1.12, with a second alpha with breaking changes in Kubernetes v1.13. This post summarizes the changes in the beta release.…
Kubernetes 1.17 Feature: Kubernetes In-Tree to CSI Volume Migration Moves to Beta
The Kubernetes in-tree storage plugin to Container Storage Interface (CSI) migration infrastructure is now beta in Kubernetes v1.17. CSI migration was introduced as alpha in Kubernetes v1.14. Kubernetes features are generally introduced as…