Kubescape became a CNCF incubating project

Created in ARMO, Kubescape is a security platform for Kubernetes that offers hardening, posture management, and runtime security capabilities. It scans clusters, YAML files, and Helm charts and detects various misconfigurations. In December 2022, CNCF accepted it as a Sandbox project; last month, the CNCF TOC voted to move it to the incubating level.

More details: official announcement; incubation issue.

#news #security #cncfprojects

Don’t miss the news regarding five recent critical vulnerabilities in ingress-nginx, including CVE-2025-1974 scored at 9.8 CVSS!

The Kubernetes blog post states that over 40% of Kubernetes administrators rely on ingress-nginx and should take action immediately. Otherwise, a malicious user with no credentials can take over your Kubernetes cluster by exploiting configuration injection vulnerabilities via the Validating Admission Controller.

The latest ingress-nginx releases, v1.12.1 and v1.11.5, are already available with all five vulnerabilities fixed.

Find more details in this post from the Kubernetes Security Response Committee and this detailed article from Wiz.

#news #security

GitHub Dependabot now supports Helm. By leveraging the Dependabot version updates, you can ensure the Helm dependencies of your app hosted on GitHub are up to date.

Currently, it works only with image updates in values.yaml, yet a support for the kustomization.yaml files might be added later.

Find more details in the formal announcement and this issue.

#news #security

Launched in November 2024, the GitHub Secure Open Source Fund aims to secure the supply chain at scale. This Fund conducted two educational, collaborative sessions on security, bringing together 125 maintainers from 71 Open Source projects. They remediated 1100+ vulnerabilities, issued 50+ new CVEs, revealed 176 leaked secrets, and prevented 92 new secrets from being leaked.

Those sessions covered such Open Source projects as Flux, bootc, nixpkgs, Oh My Zsh, Ollama, and many more. The next session is scheduled for September. Find more details in this blog post.

#news #security #GitHub

PodCertificateRequests is a new API (introduced in Kubernetes v1.34 as alpha) that enables the provisioning of certificates to workloads running as Pods within a cluster. Here’s a controller to simplify leveraging this new feature.

Pod-certificate-signer is a controller that creates PodCertificateRequest for your Pods with a custom x509 signer. This tool:
- signs TLS/mTLS certificates for Pods (or denies issuing them based on the relevant configuration);
- allows you to use Pod annotations for certificate configurations;
- validates requests by checking whether the CA-provided or mounted files exist and ensuring that the CA is valid;
- logs all decisions and errors.

Language: Go | License: Apache 2.0 | 1 ⭐️

▶️ GitHub repo

#tools #security

Kyverno became a CNCF Graduated project

Kyverno, a Kubernetes-native policy engine originally developed in Nirmata, has become the latest addition to the list of CNCF Graduated projects. About 6 hours ago, the CNCF Technical Oversight Committee completed the relevant voting process for this project.

Today’s Kyverno adopters include Vodafone, Deutsche Telekom, Saxo Bank, LinkedIn, Spotify, US DoD Platform One, OVHcloud, and many other well-known organisations worldwide.

#cncfprojects #news #security

Can luring random online attackers into your Kubernetes clusters be fun or even useful? At least, we have a tool to try it out with minimal effort.

Koney is a Kubernetes operator that implements so-called “deception policies” to discover and deter malicious users. Currently, it supports honeytokens as the only deception method by:

- creating fake “sensitive” files, such as /run/secrets/koney/service_token, in all selected Pods;
- monitoring the attempts to access them by collecting alerts from the Cilium’s Tetragon operator or via a smaller eBPF-powered file access monitoring tool (kivebpf);
- logging these events and, optionally, sending alerts to external systems (currently, it supports only Dynatrace).

Future project plans include adding other deceptive techniques (HTTP endpoints and payloads) and integrating the operator with Kyverno policies.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 89 ⭐️

#tools #security

Minimus introduced free hardened container images

At the end of June, Minimus Community Edition was announced. This project made “hundreds of continuously built from source, near-zero CVE container images” freely available. There are images and Helm charts, all classified by the following categories: Apps, Base, Data, Dev, Infra, and Utils. Some of them feature validated FIPS, CIS, NIST SP 800-190, and STIG compliance. You can find the full catalog here.

#news #security

Confidential Containers became a CNCF Incubating project

Another level up has just happened in the CNCF, with its TOC accepting moving Confidential Containers to the Incubating level. This project enables confidential computing by leveraging hardware-based TEEs (Trusted Execution Environments) to protect containers and data by encrypting data during computation.

Confidential Containers started in 2021 by Red Hat, Intel, IBM, and other companies. It was accepted into the CNCF Sandbox in March 2022. Today, this technology is used in IBM LinuxONE, Red Hat OpenShift, Kubermatic KubeOne, Alibaba Cloud, and several other solutions.

#news #cncfprojects #security

Another kube-oidc-proxy fork is alive, featuring multi-issuer authentication to managed Kubernetes clusters.

This new project, created by Rafal Pieniazek, implements a reverse proxy that enables authentication from multiple OIDC issuers at once to your managed K8s clusters, such as EKS, GKE, and AKS. To achieve this, the proxy sits in front of the API server, validates the bearer token against required OIDC issuers, and maps the token's claims to a Kubernetes identity. Then, impersonated headers for the mapped user are added, so that existing RBAC stays authoritative.

P.S. This project originates from kube-oidc-proxy by Tremolo Security, which itself is an active fork of the eponymous project by Jetstack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 17 ⭐️

#tools #security