Kubernetes 1.35 brings changes around security: 🚮 Removal of cgroup v1 support 🪪 Increased verifications when pulling images 🦹🏻 Limits to impersonation 🌐 User namespaces when using the host network 🔑 Token secrets for CSI drivers And more! www.sysdig.com/blog/kuberne... #Kubernetes #Security #k8s
Post
🪪 Increased verifications when pulling images in Kubernetes 1.35: 🔎 Performs credentials check when accessing images, not only on pull. 👥 To keep images secure in multi-tenant clusters. ℹ️ www.sysdig.com/blog/kuberne...
🌐 User namespaces when using the host network in Kubernetes 1.35: 🛡️ Pods using the host network no longer need to also use the host users. 🔐 They can run as privileged without being root. ℹ️ www.sysdig.com/blog/kuberne...
🦹🏻 Constrained impersonation in Kubernetes 1.35: 💡 Impersonator: User acting as another user. 🚧 They are now limited to their original permissions. 🛡️ This prevents privilege escalations. ℹ️ www.sysdig.com/blog/kuberne...
0 reposts0 likes
🔑 Token secrets for CSI drivers in Kubernetes 1.35: 🗂️ New field to provide secrets to CSI drivers. 🛡️ Keeping sensitive data separate from configuration. ℹ️ www.sysdig.com/blog/kuberne...
🚮 Kubernetes 1.35 is letting go of some old technology: cgroup v1 in favor of cgroup v2 SPDY in favor of WebSockets gogo protobuf in favor of standard libs ℹ️ www.sysdig.com/blog/kuberne...