SIG Security: Succession Pla ...
summary
Kubernetes SIG Security runs an official CVE feed (JSON + RSS), operates a HackerOne bounty and a third-party audit program (2018, 2021, now 2025 third-party audit producing responsible-disclosure findings), and maintains tooling like the sneak scanner and go-check jobs moved into less-trusted infra. Ongoing work includes converting the CVE feed to OSV, cleaning up stale audit issues (some need KEPs), finishing scheduler hardening sections, and fixing problems like the API server’s 12‑month self-signed cert that crashes long‑running clusters.
AI-written summary · about
chapters (9)
- 0:00SIG Security introduction
- 1:08What SIG Security does for Kubernetes
- 3:45Community-driven security
- 5:11Future plans overview
- 7:58Third-party audits
- 12:50Kubernetes security docs
- 16:45SIG Security tooling
- 21:06How to join SIG Security
- 22:50Q&A
related talks
22mSecurity Through Transparency: Kubernetes SIG Security Update
37mSIG Security Update: We Lift Tog...
34mSIG Security: Empowerment Through Autonomy
36mSIG Auth Deep Dive
11mKeynote: Securing Kubernetes, the Upstream Way
01h 32mSIG Auth Update and Deep Dive
22mIntro: CNCF Security SIG
23mGet In Containerds, We’re Going Securing: Kubern...