►
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Security Through Transparency: Kubernetes SIG Security Update - Ian Coldwater, Twilio; Savitha Raghunathan, Red Hat; Rey Lejano, SUSE; Pushkar Joglekar, VMware
Kubernetes SIG Security is a newer SIG, dedicated to improving Kubernetes security by providing space for learning together, sharing our expertise, and building bridges between SIGS and externally with the broader security community. We’re here this KubeCon to tell you about what we’ve been up to! Come for this session featuring updates from our docs, tooling, and third party security audit subgroups about our efforts to keep Kubernetes secure through transparency, not obscurity. Stay to learn how you can get involved. Happy Honking!
A
C
A
So
what
is
sick
security,
sick
security
is
a
relatively
new
sig
in
kubernetes
not
to
be
confused
with
tag
security
out
of
the
cncf
and
what
we
do
is
we
are
responsible
for
creating
space
for
people
who
are
interested
in
contributing
to
the
security
of
the
kubernetes
project
to
come
and
discuss
security
topics
with
each
other
work
on
deciding
the
direction
of
security
within
the
project.
What
our
kubernetes
enhancement
proposals
will
look
like
what
features
go
into
alpha
and
beyond,
and
also
we
are.
A
B
B
So
before
I
dive
deep
into
what
the
project
is,
I
want
to
take
this
opportunity
to
clear
something.
Like
everyone
has
some
kind
of
question
like
there
is
already
a
sake
for
documentation.
Why
do
we
have
another
project
for
like
security
documentation?
Well,
the
sick
documentation
does
a
whole
lot
of
things
like
they
host
the
website.
B
They
take
care
of
multiple
kubernetes
version
related
documentation.
They
update
the
overall
content
and
they
also
kind
of
like
take
care
of
the
localization,
and
they
also
do
a
little
bit
of
security
work,
whereas
the
security
documentation,
sub
project
has
only
only
one
and
only
focus,
which
is
like
improving
the
security
content
of
the
kubernetes
website.
The
goal
of
the
project
is
to
make
security
kubernetes
website
a
one-stop
shop
for
all
information
related
to
kubernetes
security
right
now.
It's
not
the
way
that
you
have
to
look
outside
of
the
kubernetes
website.
B
B
I'm
not
saying
that
it's
gonna
make
everything
super
secure
and
just
trust
it
blindly,
which
no
one
should,
and
everyone
should
have
security
in
their
mind
when
they
are
doing
things,
but
it
will
actually
provide
some
kind
of
like
base
secure
template,
so
they
can
just
build
on
top
of
it,
and
that
is
one
of
the
areas
that
we
are
working
on.
Improving
the
examples,
adding
more
examples,
making
sure
the
security
context
and
those
examples
are
right.
B
B
B
So
we
did
a
review
of
the
blog
post
and
it
is
available
in
the
kubernetes
website.
So
if
you
haven't
had
the
chance
to
go,
take
a
look
at
it.
Please
do
it's
a
complimentary
content,
it's
not
something
like
a
critic
or
a
review
kind.
It's
more
like,
like
you,
have
to
read
the
original
guide,
and
then
we
have
additional
things
like
some
of
the
new
features
that
went
inside
went
into.
B
The
recent
releases
have
not
been
covered
in
the
guide
hardening
guide,
and
that
is
what
we
have
and
links
to
the
caps
and
links
to
the
blog
post
and
related
stuff.
So
that's
one
thing
that
we
published
recently
and
then
the
next
one
that
we
are
working
on
is
a
threat
model
for
kubernetes
admin,
admission
control
admission.
I
got
that
right,
kubernetes,
admission
control,
so
that
is
something
that
we
are
working
on
and
it's
going
to
be
super
useful
for
end
users.
So
I
watched
that
admin.
B
He
just
deployed
things
blindly,
everything
with
default
config,
which
should
never
ever
go
into
prediction
ever
so
this
guide
is
going
to
have
all
the
attack
vectors
and
how
to
mitigate
and
more
information
about
that.
So
that's
going
to
come
out
in
this
month
or
next
month
in
a
couple
months,
so
keep
an
eye
out
for
that
one.
B
B
What
can
we
move
on
the
next
slide?
Yeah,
of
course,
thank
you.
So
we
we
are
working
on
two.
We
want
to
work
on
two
major
things.
How
many
of
you
have
had
issues
with
our
back
right?
Everyone
right,
I
could
never
find
a
documentation
and
I
have
never
gotten
it
right
in
the
first
go
at
all.
I
know
there
are
like
multiple
policy
related
things
coming
up.
There
are
like
services,
I
don't
know
if
everyone
is
going
to
use
them
or
not,
but
still
our
back
is
important.
B
So
that
is
the
next
project
that
we
want
to
have
like
have
a
decent
our
back
guide
available
on
the
kubernetes
website,
so
that
everyone
has
a
baseline
to
deploy
that
the
next
one
is
a
security
checklist
which
is
closer
to
my
heart.
I
used
to
be
a
platform
engineer
and
I
would
have
loved
to
have
a
checklist
when
I
deployed
a
cluster
like
check,
check
check.
B
Oh,
I
have
deployed
a
cluster
which
is
secure
to
an
extent
by
default
right,
so
that
is
one
of
the
project,
so
this
is
where
we
need
our
need
all
your
help.
So
if
any
of
this
is
interesting,
please
feel
free
to
stop
by
say
hi
if
you're
a
new
contributor
who
want
to
get
into
security.
You
are
intermediate.
B
So
I'm
pretty
dreamy
right
now
so
and
so
well,
we
need
your
help
so
and
we
meet
once
every
month
on
the
first
thursday
at
2,
2
p.m.
Eastern
and
we
do
most
of
the
things
done,
asynchronously
asynchronously
on
slack.
So
if
you
cannot
make
it
to
the
meeting
time,
that
is
totally
fine
go
to
the
slack
channel.
If
you
have
a
new
idea
post
there
and
the
awesome
folks
from
the
security
community
will
be
there
to
jump
in
shout
out
like
plus
one
your
ideas
add
their
comments
and
every
like.
B
If
you're
looking
for
motivation
it's
there
and
if
you're
looking
for
collaboration,
it's
there,
and
I
do
have
to
tell
one
real
thing
quick,
I
missed
something
I
do
realize
that
I
asked
for
help
and
these
topics
are
really
really
big.
I
know
about
the
time
commitment,
and
this
is
where
collaboration
comes
into
play.
We
in
seek
security,
love
collaboration.
B
C
All
right
so
hello,
my
name
is
ray.
I
am
the
sub
project
owner
of
the
third
party
security
audits,
so
last
third
party
security
audits
occurred
in
2019.
We
released
an
rfp
which
is
now
closed
this
year.
We
are
currently
in
the
process
of
selecting
a
vendor,
so
the
the
other
goals,
of
course,
is
to
find
vulnerabilities,
fix
them
report
them
to
the
to
the
security
response
committee
as
well,
get
them
out
and
get
the
fixes
out
and
see
here.
D
C
B
C
So
in
this
year's
security
audit,
we
did
include
see
a
csi
secret
store
because
we
do
see
a
lot
more
end:
users
using
csi
secret
store,
meaning
that
you
could
keep
your
secrets
outside
externally
and
the
pod
can
mount
them
as
a
volume
and
use
it.
So
that's
also
including
all
the
core
components
of
the
of
the
kubernetes
project.
Could
you
go
next
slide
please?
C
So
this
is
the
current
audit
scope
here.
So,
as
you
see
in
the
very
bottom,
oh
we
have
the
core
components
in
the
very
bottom.
We
do
have
csi
secret
store,
so
next
slide
as
well.
Sorry,
that's
too
fast!
So
so,
what's
new
with
the
security
audits
group
as
well,
is
this
roadmap
because
we
do
since
this
project
is
continuing
to
grow.
There
are
components
like
like
like
cluster
api.
C
Now
we
can
include
in
future
audits
that,
and
also
we
want
to
do
more
frequent
security
audits
than
more
focus
as
well.
So
part
of
this
as
well
is
that
we've
started
doing
self-assessments,
which
is
more
about
that
later,
and
we
could
tie
in
some
of
the
self-assessments
into
what
is
going
to
be
included
into
the
third-party
security
audits.
It's
not
required,
but
doing
a
self-assessment
helps
broad
or
help
strengthen
your
security
posture,
so
you'll
get
a
better
result
out
of
a
third-party
security
audit.
C
D
D
D
Then
we
have
helped
sig
release,
bump
few
images
and
some
build
time
dependencies
we've
been
able
to
remove
some
code
that
wasn't
needed
or
was
malicious
and
we've
also
been
hosting
learning
sessions
in
the
last
two
three
months.
So
we
have
had
steven
join
us
talk
about
how
the
release
image
promotion
cycle
works.
D
We
have
had
adolfo
who
is
our
track
host
join
us
for
talking
about
s
bombs
for
kubernetes,
so
we
continue
to
do
that
every
third
tuesday
of
the
month,
if
you
have
a
topic
and
want
to
present
reach
out
to
me
and
we'll
probably
set
up
something
for
you.
So
this
is
what
we
have
done
so
far,
and
next
slide
next
slide
is
what
we
are
going
to
do
next.
D
So
the
main
thing
that's
coming
soon
is
the
triage
policy,
so
we
discussed
that
we
have
jobs
running
and
there
will
be
vulnerabilities
sooner
rather
than
later.
How
do
you
triage
that
with
different
sigs
and
all
of
our
security
friends?
So
that's
an
iterative
process
that
we've
been
working
on
the
next
one
after
that
is
trying
to
start
a
shadow
triage
program.
D
Learning
from
what
sigrillis
has
been
doing
with
their
shadow
program,
where
we'll
allow
new
newcomers
and
new
contributors
to
join
us
and
triage
it,
some
of
the
vulnerabilities
with
us
and
as
they
grow
in
their
role,
they
become
peer
triagers.
So
that's
coming
up
next
and
then
the
whole
idea
for
doing
what
we
do
today
in
terms
of
managing
vulnerabilities
is
to
reduce
the
gap
where
the
detection
time
for
any
new
vulnerability,
that
is
in
kubernetes
code
or
in
images,
is,
could
always
be
shortened
and
the
remediation
time
could
also
be
shorted.
D
So
that's
what
tooling
eventually
intends
to
do
with
the
job
that
we
are
currently
working
on
and
then
the
helping
never
ends
so
we'll
continue
to
help
adolfo
with
and
all
the
release
engineering
team
on
all
the
s1
work,
the
salsa
compliance
work,
they're
doing
really
excited
about
how
that's
going
to
improve
and
strengthen
kubernetes
as
a
whole
and
then.
Finally,
as
we
discussed,
we
have
57
enhancement
proposals
for
this
release
and
if
the
graph
continues
to
go
up
and
up
we'll,
probably
have
more
next
release.
D
D
D
The
next
thing,
fortunately,
because
seems
like
it's
a
good
thing.
That's
going
on
that
other
sub
projects
in
within
kubernetes
are
now
saying:
hey.
We
want
to
do
a
self
assessment
too.
So
now
we
are
trying
to
create
an
intake
form
for
everyone
where
everyone
can
join
and
say
we
want
to
do
a
self-assessment,
raise
their
hand
and
then
we'll
join
with
them
partner
with
them
and
do
something
similar
that
we're
doing
for
cluster
api
and,
lastly,
I'll
pass
it
on
back
to
ian
for
wrapping
up
this
session.
A
A
You
know,
because
we
are
all
responsible
for
the
security
of
the
kubernetes
project,
no
matter
where
you
are
in
your
kubernetes
journey
and
creating
that
kind
of
welcoming
environment
and
a
community
where
people
can
like
feel
safe
and
good
to
come
in
when
they
are
learning
and
we're
all
learning
really
and
like
do
stuff
and
help
with
the
project
and
help
secure.
It
has
been
really,
I
think,
successful.
A
It's
gone
really
well,
and
it's
been
really
amazing
to
see
these
new
leaders
like
grow
and
shine
so
as
got
mentioned,
we're
all
about
collaboration
here
at
sig
security,
and
we
really
like
when
new
contributors
get
involved
and
also
we
would
like
new
contributors
to
get
involved.
So
if
you
are
somebody
who
wants
to
contribute
to
the
project
or
the
security
of
the
project,
we
are
all
super
friendly.
You
can
find
us
in
meetings
that
are
bi-weekly.
A
They
are
thursdays
at
11,
pacific
time,
and
also
we
do
a
lot
of
business
on
slack.
So
we
have
a
sig
security
channel
on
slack
that
you
can
come
talk
to
us,
as
I
said,
we're
all
super
friendly
and
if
you
have
ideas
or
things
that
you're
thinking
about
or
questions
that
you
have
or
a
kept
that
you
want
to
bring
up
or
a
kept
that
you
want
to
comment
on
anything
like
that.