Blog: Announcing the Auto-refreshing Official Kubernetes CVE Feed

Author: Pushkar Joglekar (VMware)

A long-standing request from the Kubernetes community has been to have a
programmatic way for end users to keep track of Kubernetes security issues
(also called “CVEs”, after the database that tracks public security issues across
different products and vendors). Accompanying the release of Kubernetes v1.25,
we are excited to announce availability of such
a feed as an alpha
feature. This blog will cover the background and scope of this new service.

Motivation

With the growing number of eyes on Kubernetes, the number of CVEs related to
Kubernetes have increased. Although most CVEs that directly, indirectly, or
transitively impact Kubernetes are regularly fixed, there is no single place for
the end users of Kubernetes to programmatically subscribe or pull the data of
fixed CVEs. Current options are either broken or incomplete.

Scope

What This Does

Create a periodically auto-refreshing, human and machine-readable list of
official Kubernetes CVEs

What This Doesn’t Do

  • Triage and vulnerability disclosure will continue to be done by SRC (Security
    Response Committee).
  • Listing CVEs that are identified in build time dependencies and container
    images are out of scope.
  • Only official CVEs announced by the Kubernetes SRC will be published in the
    feed.

Who It’s For

  • End Users: Persons or teams who use Kubernetes to deploy applications
    they own
  • Platform Providers: Persons or teams who manage Kubernetes clusters
  • Maintainers: Persons or teams who create and support Kubernetes
    releases through their work in Kubernetes Community – via various Special
    Interest Groups and Committees.

What’s Next?

In order to graduate this feature, SIG Security
is gathering feedback from end users who are using this alpha feed.

So in order to improve the feed in future Kubernetes Releases, if you have any
feedback, please let us know by adding a comment to
this tracking issue or
let us know on
#sig-security-tooling
Kubernetes Slack channel.
(Join Kubernetes Slack here)

A special shout out and massive thanks to Neha Lohia
(@nehalohia27) and Tim
Bannister (@sftim) for their stellar collaboration
for many months from “ideation to implementation” of this feature.

Originally posted on Kubernetes – Production-Grade Container Orchestration
Author:

Deja una respuesta

Tu dirección de correo electrónico no será publicada. Los campos obligatorios están marcados con *