Language Selection

English French German Italian Portuguese Spanish

Kubernetes and Containers Leftovers

Filed under
Server
OSS
Security
  • Production-Ready Kubernetes Cluster Creation with kubeadm

    kubeadm is a tool that enables Kubernetes administrators to quickly and easily bootstrap minimum viable clusters that are fully compliant with Certified Kubernetes guidelines. It’s been under active development by SIG Cluster Lifecycle since 2016 and we’re excited to announce that it has now graduated from beta to stable and generally available (GA)!

    This GA release of kubeadm is an important event in the progression of the Kubernetes ecosystem, bringing stability to an area where stability is paramount.

    The goal of kubeadm is to provide a foundational implementation for Kubernetes cluster setup and administration. kubeadm ships with best-practice defaults but can also be customized to support other ecosystem requirements or vendor-specific approaches. kubeadm is designed to be easy to integrate into larger deployment systems and tools.

  • Docker Looks to Improve Container Development With Enterprise Desktop

    Docker CEO Steve Singh kicked off DockerCon Europe 2018 here with a bold statement: Companies need to transform, or risk becoming irrelevant.

    According to Singh, Docker is a key tool for enabling organizations to transform their businesses. To date for enterprises, the core Docker Enterprise Platform has been largely focused on operations and deployment, with the community Docker Desktop project available for developers to build applications. That's now changing with the announcement at DockerCon Europe of the new Docker Desktop Enterprise, adding new commercially supported developer capabilities to help corporate developers fully benefit from Docker.

    "Our commitment is to provide a development experience that makes it easy to build applications with one platform, upon which you can build, ship and run any application on any infrastructure," Singh said.

  • Canonical publishes auto-apply vulnerability patch for Kubernetes
  • Critical Kubernetes privilege escalation disclosed

    A critical flaw in the Kubernetes container orchestration system has been announced. It will allow any user to compromise a Kubernetes cluster by way of exploiting any aggregated API server that is deployed for it. This affects all Kubernetes versions 1.0 to 1.12, but is only fixed in the supported versions (in 1.10.11, 1.11.5, and 1.12.3)

Why Docker Swarm Remains Important

  • Why Docker Swarm Remains Important

    Docker Swarm remains a core element of Docker Inc's plans and that's not going to change anytime soon. That's the strong message coming from Docker CEO Steve Singh, during a briefing with press and analysts at the Dockercon Europe 2018 event here.

    A year ago, in October 2017 at the last Dockercon Europe event, Docker announced that it would be support the erstwhile rival Kubernetes container orchestration system. At the time, Docker's management committed to continuing to support Swarm and now a year later, they are still on that same path. Docker has been developing its own Swarm system since December 2014.

    "We have many clients that continue to run Docker Swarm in production," Singh said. "Swarm continues to be a very well adopted container orchestration tool, in large part, honestly because it's ridiculously simple to use."

By Steven J. Vaughan-Nichols

  • ​Kubernetes' first major security hole discovered

    Kubernetes has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered. And the bug, CVE-2018-1002105, aka the Kubernetes privilege escalation flaw, is a doozy. It's a CVSS 9.8 critical security hole.

    With a specially crafted network request, any user can establish a connection through the Kubernetes application programming interface (API) server to a backend server. Once established, an attacker can send arbitrary requests over the network connection directly to that backend. Adding insult to injury, these requests are authenticated with the Kubernetes API server's Transport Layer Security (TLS) credentials.

Critical Kubernetes Bug

  • Kubernetes Discloses Major Security Flaw

    Kubernetes disclosed a critical security flaw — the container orchestration tool’s first major vulnerability to date — and released Kubernetes 1.13.

    But first: the security flaw. It affects all Kubernetes-based products and services, and it gives hackers full administrative privileges on any compute node being run in a Kubernetes cluster.

    As Red Hat’s Ashesh Badani wrote, “This is a big deal. Not only can this actor steal sensitive data or inject malicious code, but they can also bring down production applications and services from within an organization’s firewall.”

  • Critical Kubernetes Bug Gives Anyone Full Admin Privileges [Ed: No, not everyone. Only those who already have access to that particular system.]

What does the Kubernetes privilege escalation flaw mean

Article by Lucian Constantin

  • Critical Vulnerability Allows Kubernetes Node Hacking

    Kubernetes has received fixes for one of the most serious vulnerabilities ever found in the project to date. If left unpatched, the flaw could allow attackers to take over entire compute nodes.

    “With a specially crafted request, users that are allowed to establish a connection through the Kubernetes API server to a backend server can then send arbitrary requests over the same connection directly to that backend, authenticated with the Kubernetes API server’s TLS credentials used to establish the backend connection,” the Kubernetes developers said in an advisory.

More on Kubernetes Security Flaw

  • Before Patched, Kubernetes Security Flaw Spread to OpenShift

    A security flaw discovered in the de facto standard Kubernetes cloud container orchestrator allowed unauthorized users access to Kubernetes clusters and the data they contain.

    The “privilege escalation vulnerability” announced Monday (Dec. 3) by developers affects versions 1.0 and higher of the Kubernetes orchestrator along with Red Hat OpenShift container platform. Red Hat rated the vulnerability as “critical,” denoting its potential impact on production operations.

  • Upgrades Recommended To Address Critical Kubernetes Flaws

    The flaws are associated with privilege "abuse," but there's also a problem with being able to exploit calls to Kubernetes API servers. Default Kubernetes configurations permit "all users (authenticated and unauthenticated)" to make such API server calls, according to the announcement, so it's a wide-open issue. Attacks can get initiated by a "specially crafted request" sent to the back end server, according to the Kubernetes announcement, which omitted the details.

Kubernetes hit by major security flaw

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

Graphics: Red Hat's Wayland Agenda and AMD Begins Queueing Graphics Driver Changes For The Linux 5.3 Kernel

  • Hans de Goede: Wayland itches summary
    1. Middle click on title / header bar to lower the Window does not work for native apps. Multiple people have reported this issue to me. A similar issue was fixed for not being able to raise Windows. It should be easy to apply a similar fix for the lowering problem. There are bugs open for this here, here and here. 2. Running graphical apps via sudo or pxexec does not work. There are numerous examples of apps breaking because of this, such as lshw-gui and usbivew. At least for X11 apps this is not that hard to fix. But sofar this has deliberately not been fixed. The reasoning behind this is described in this bug. I agree with the reasoning behind this, but I think it is not pragmatic to immediately disallow all GUI apps to connect when run as root starting today.
  • Hans de Goede: Better support for running games under Wayland (with GNOME3/mutter as compositor)
    First of all I do not want people to get their hopes up about $subject of this blogpost. Improving gaming support is a subjects which holds my personal interest and it is an issue I plan to spend time on trying to improve. But this will take a lot of time (think months for simple things, years for more complex things).
  • AMD Begins Queueing Graphics Driver Changes For The Linux 5.3 Kernel
    Being past the Linux 5.2 kernel merge window, AMD's open-source Linux graphics driver developers have already begun queuing changes anticipated for Linux 5.3 via a work-in-progress tree. Given the short time that this 5.3 WIP tree has been around, there isn't too much exciting about the changes -- yet. But surely over the weeks ahead it will get interesting. Making things particularly interesting is that we are expecting initial Navi support to make it for Linux 5.3... In recent weeks AMD began pushing AMDGPU LLVM compiler back-end changes for GFX10/Navi and we expect the AMDGPU DRM kernel driver enablement to come for Linux 5.3. Linux 5.3 will already be arriving after the rumored release of the first Navi graphics cards so having to wait past 5.3 for mainline support would already be tragic. But given the recent LLVM activity, we expect AMD to push out the Navi kernel driver changes soon. For that likely massive patch-set to be reviewed in time, the Navi patches would need to make their debut within the next few weeks.

today's howtos and programming

Fedora 30 Workstation review - Smarter, faster and buggier

Fedora 30 is definitely one of the more interesting releases of this family in a long-time. It brings significant changes, including solid improvements in the desktop performance and responsiveness. Over the years, Fedora went from no proprietary stuff whatsoever to slowly acknowledging the modern needs of computing, so now it gives you MP3 codecs and you can install graphics drivers and such. Reasonable looks, plus good functionality across the board. However, there were tons of issues, too. Printing to Samba, video screenshot bug, installer cropped-image slides, package management complications, mouse cursor lag, oopses, average battery life, and inadequate usability out of the box. You need to change the defaults to have a desktop that can be used in a quick, efficient way without remembering a dozen nerdy keyboard shortcuts. All in all, I like the freshness. In general, it would seem the Linux desktop is seeing a cautious revival, and Fedora's definitely a happy player. But there are too many rough edges. Well, we got performance tweaks after so many years, and codecs, we might get window buttons and desktop icons one day back, too. Something like 6/10, and definitely worth exploring. I am happy enough to do two more tests. I will run an in-vivo upgrade on the F29 instance on this same box, and then also test the distro on an old Nvidia-powered laptop, which will showcase both the support for proprietary graphics (didn't work the last time) and performance improvements, if they scale for old hardware, too. That's all for now. Read more

Events: Automotive at LF, Linux Clusters Institute, Linux Plumbers Conference (LPC)

  • Automotive Linux Summit and Open Source Summit Japan Keynote Speakers and Schedule Announced
    The Linux Foundation, the nonprofit organization enabling mass innovation through open source has announced the speaker line up for Open Source Summit Japan and Automotive Linux Summit. One registration provides access to all content at both events, which will be held July 17-19 at the Toranomon Hills Forum in Tokyo. Open Source Summit Japan (OSSJ) and Automotive Linux Summit (ALS) will bring together top talent from companies on the leading edge of innovation including Toyota Motor Corporation, Uber, Intel, Sony, Google, Microsoft and more. Talks will cover a range of topics, with ALS talks on everything from infrastructure and hardware to compliance and security; and OSSJ sessions on AI, Linux systems, cloud infrastructure, cloud native applications, open networking, edge computing, safety and security and open source best practices.
  • Register Now for the 2019 Introductory Linux Clusters Institute Workshop
    Registration is now open for the 2019 Linux Clusters Institute (LCI) Introductory Workshop,which will be held August 19-23, 2019 at the Rutgers University Inn & Conference Center in New Brunswick, NJ. This workshop will cover the fundamentals of setting up and administering a high-performance computing (HPC) cluster and will be led by leading HPC experts.
  • Additional early bird slots available for LPC 2019
    The Linux Plumbers Conference (LPC) registration web site has been showing “sold out” recently because the cap on early bird registrations was reached. We are happy to report that we have reviewed the registration numbers for this year’s conference and were able to open more early bird registration slots. Beyond that, regular registration will open July 1st. Please note that speakers and microconference runners get free passes to LPC, as do some microconference presenters, so that may be another way to attend the conference. Time is running out for new refereed-track and microconference proposals, so visit the CFP page soon. Topics for accepted microconferences are welcome as well.