The document outlines recent Kubernetes security updates and new features, such as enhanced service account token management, the introduction of runtime class capabilities for heterogeneous container runtimes, and node restriction improvements. It also highlights the graduation of secret data encryption at rest and dynamic audit backend configurations. Additional announcements include a forthcoming bug bounty program and references to further resources and community engagement.

1. Kubernetes Security
Updates
Suraj Deshmukh

2. $ whoami
● Suraj Deshmukh
● works @ Kinvolk
● Twitter @surajd_
● Kubernetes Slack @surajd
● Blog suraj.io

3. ServiceAccount

4. Features
● Fixed limited duration
● Every pod gets a different service account token
● Kubelet handles rotation of the token
● Force rotate by restarting the pod
● Not stored in secret, directly mounted inside the pod
● Need to re-read the token since it changes periodically
● Specify audiences so token is valid to talk to only those services

5. New API
TokenRequest
TokenRequestProjection
BoundServiceAccountTokenVolume
KEP: Service Account Token Volumes & Bound Service Account Tokens

6. RuntimeClass

7. Features
● Run heterogeneous container runtimes in cluster, allows you to run VMs and
containers together.
● Scheduling based on RuntimeClass is work in progress.
KEP: Runtime Class

8. ● Field in PodSpec called runtimeClassName
● RuntimeClass
New API

9. NodeRestriction

10. Features
● Add restriction to kubelet
● Node isolation
● Prevent nodes from updating taints & their own labels specifically
node-restriction.kubernetes.io/*
● Can’t delete the node object itself
● Warn on whitelisted modifications

11. Encrypting Secret Data at Rest

12. Features
● Graduated from experimental
● Define what resources you want to be encrypted
● Supports various encryption providers: aescbc, secretbox, aesgcm,
kms
● Solves the long standing problem of credentials not being safe with
Kubernetes.

13. EncryptionConfiguration
New API

14. Dynamic Audit backend

15. Features
● Dynamically configure the audit backends
● No need to provide information to apiserver via flags

16. New API
AuditSink

17. Other announcements
● Bug bounty program is coming to Kubernetes

18. References
● Transition ServiceAccount admission controller to improved service account token volumes #70679
● Kubernetes Contributor Summit 2018 - Security Through the Ages
● Deep Dive: Container Identity WG - Greg Castle & Michael Danese, Google
● Encrypting Secret Data at Rest
● NodeRestriction
● Dynamic Backend
● Audit in Kubernetes, the Future is Here - Stefan Schimanski & Maciej Szulik, Red Hat

19. Connect with us
● Twitter @k8sBLR
● Join Kubernetes slack slack.k8s.io and channel #in-dev & #in-users
● GSOC for Kubernetes announced!