Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Patch for critical privilege escalation flaw in Kubernetes

groups.google.com

Post reply on HN
Print view View original

1–9 of 9 posts

Re: Patch for critical privilege escalation flaw in Kubernetes

#3

Post by coleca »

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago.

The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

Re: Patch for critical privilege escalation flaw in Kubernetes

#4

Post by zegl »

coleca wrote: post #3

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

Kubernetes has a hard time defining itself sometimes, this behavior makes sense if you think of Kubernetes as a kernel. You either run directly on the kernel, or use a OS that adds features and LTS support to it.

I know however that there is a LTS-SIG that’s trying to figure out what Kubernetes is, and for how long old releases should be supported.

Re: Patch for critical privilege escalation flaw in Kubernetes

#5

Post by web007 »

merb wrote: post #2

hm, so only people are affected that gave users access to specific permissions that are not supposed to do everything. we only allow cluster access to people that needed cluster-admin rights anyway.. for anybody else, we abstract k8s away.

https://github.com/kubernetes/kubernetes/issues/71411 for more details, which includes:

  In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation.

Re: Patch for critical privilege escalation flaw in Kubernetes

#6

Post by segmondy »

coleca wrote: post #3

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

Yeah, that's a bit worrying, k8s needs to take security very seriously. if your k8s cluster get's compromised, it's all your machines & apps getting compromised at the exact time. This is worse than a typical remote exploit that might give access to one server or app.

Re: Patch for critical privilege escalation flaw in Kubernetes

#7

Post by andrewstuart2 »

coleca wrote: post #3

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

If you're using something like kops or kubeadm, chances are you're on the latest anyway and updating will take you all of an hour and zero downtime.

The Kubernetes project is pretty explicit about only supporting 3 minor versions back, which gives you a full 3 quarters to figure out if the changes break anything you have deployed and fix those cases. If that's too fast, you're probably an Enterprise anyway and uncomfortable with anything but vendor support.

Re: Patch for critical privilege escalation flaw in Kubernetes

#8

Post by gaius »

coleca wrote: post #3

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

1.09 was released just a year ago.

Quite normal in this space, see Docker for example.

Post reply on HN