Business
Kubernetes Policy Driven Resource Optimization with Kyverno
Introduction As organizations increasingly turn to Kubernetes to deploy and manage containerized applications, they face unique challenges in efficiently allocating…
6 min read
Author
Boris Kurktchiev
7 posts
Engineering
Rapid Mitigation of CVE-2023-2878 with Kyverno and Nirmata Control Hub
CVE-2023-2878 makes secrets-store-csi-driver before v1.3.3 log service account tokens at log level 2+. Upgrade, or use Kyverno to keep it at -v=0 or 1.
5 min read
Other
Mitigating CVE-2024-3177 & The Importance of Preparedness
Although CVE-2024-3177 has a low impact and potentially minimal attack surface, it does highlight the importance of utilizing a policy engine (Kyverno) and a central…
2 min read
Engineering
XZ: A Case Study in Open-Source Supply Chain Attacks
CVE-2024-3094 is a CVSS 10.0 backdoor in XZ Utils 5.6.0 and 5.6.1. Downgrade to 5.4.6 or move to 5.6.2, then block affected images with a Kyverno policy.
6 min read
Engineering
Locked Doors, Untrusted Keys: Securing Containers in the Wake of Leaky Vessel Vulnerabilities
Leaky Vessels (CVE-2024-21626) lets a container reach the host filesystem through runc 1.1.11 and earlier. Patch to runc 1.1.12 and audit nodes with Kyverno.
7 min read
Engineering
Preventing “Sys:All” vulnerability from ruining your day
Google Kubernetes Engine (GKE) is a popular tool for managing containerized applications. However, a critical vulnerability has been discovered in GKE that could allow…
2 min read
Engineering
Mitigating the Latest Kubernetes NGINX Ingress Controller CVEs
Ingress users can steal ingress-nginx credentials via CVE-2023-5043, CVE-2023-5044 and CVE-2022-4886. Upgrade to v1.9.0 and block the annotations with Kyverno.
3 min read