Stay Secure: Keep an Eye on the New Automatic CVE Feed for Kubernetes

A long-standing wish of the Kubernetes community has been to create a programmatic way to track security issues in Kubernetes (also known as “CVEs”). With the release of Kubernetes v1.25, we are pleased to announce the availability of such a feed as an alpha feature. In this blog post, we will explore the background and scope of this new service.

Motivation

With the increasing focus on Kubernetes, the number of CVEs associated with Kubernetes has also risen. Although most CVEs that directly, indirectly, or transitively affect Kubernetes are regularly addressed, there is no single place where Kubernetes end users can programmatically subscribe to or retrieve data on resolved CVEs. The current options are either flawed or incomplete.

Scope

What does this feed do?

It creates a regularly and automatically updated, human- and machine-readable list of official Kubernetes CVEs.

What does this feed not do?

• The triage and disclosure of vulnerabilities will continue to be handled by the SRC (Security Response Committee).
• Listing CVEs identified in build-time dependencies and container images is out of scope.
• Only official CVEs announced by the Kubernetes SRC will be published in the feed.

Who is this feed for?

• End Users: Individuals or teams using Kubernetes to deploy applications they own.
• Platform Providers: Individuals or teams managing Kubernetes clusters.
• Maintainers: Individuals or teams building and supporting Kubernetes releases by working within the Kubernetes community across various interest groups and committees.

Implementation Details

A supporting contributor blog post has been published, detailing how this CVE feed was implemented to ensure the feed is adequately protected against tampering and automatically updated after a new CVE is announced.

What’s Next?

To further develop this feature, SIG Security is collecting feedback from end users who use this alpha feed.

If you have feedback, please let us know by commenting on this tracking issue or informing us in the #sig-security-tooling Kubernetes Slack channel. (Sign up for Kubernetes Slack here)

A special thanks to Neha Lohia (@nehalohia27) and Tim Bannister (@sftim) for their outstanding collaboration over many months from “idea to implementation” of this feature.

Source: Kubernetes Blog