KubeCon + CloudNativeCon North America 2024

Ensuring the security of Kubernetes is a team sport. When a CVE is reported to the SRC for Kubernetes, a process is kicked off that involves a lot of coordination between SRC, contributors from different SIGs, and SIG Release, ultimately resulting in new Kubernetes Releases. Once released, an automatic CVE feed provides a programmatic way to understand the security of the releases. For other security issues, like dependency vulnerabilities and false positives, it isn’t quite as easy to get a full picture. SIG Security, SIG Release, and SRC are working to make this better and in this session we will share more about how things work today and what we plan to do in the future to improve the security visibility of the releases and artifacts produced by the project!