The Dependency Jungle: Supply Chain Security and Kubernetes
summary
A Snyk-style sneak scan on the Kubernetes repo surfaces ~20 CVE hits and three high-severity ones that get targeted: an insecure randomness bug from go-uuid gets removed by updating the Azure Go SDK (merged Apr 23), a DNS CVE gets fixed by a backward-compatible PR and a three-week merge cycle, while jwt-go abandoned remains in the graph because etcd→viper version constraints and circular module resolutions force months of coordinated bumps using go mod why and go mod graph before full removal.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:57snyk test kubernetes
- 2:50Go UUID-A Zombie
- 15:09Deep Dive One - rsc.io/quote
- 16:30But Why?
- 17:37Go Mod Graph!
- 18:09Mock!
- 18:24Removed!
- 19:14A challenge left :
related talks
24mGoing Secure with Go
40mThe Risks of Single Maintainer Dependencies
24mVulnerability Management for Go
17mUnderstanding Supply Chain Threats with Static Analysis
22mSecuring Containers Against Known Go Vulnerabilities
32mSecure and reliable development with Go
23mThe Code You Reviewed is Not the Code You Built
21mVulnerability Management for Go