Inside the CNCF Project Security Reviews
summary
CNCF funds independent security audits that run about €50–150k per audit and often take three to four weeks of code review plus black‑box testing; audits so far cover Prometheus, CoreDNS, Envoy, containerd, Notary/TUF, NATS and OPA. Findings are specific: CoreDNS cache validation bug allows poisoned responses, containerd shows one minor config issue, NATS C client: many memory and parsing bugs from C bindings, and Prometheus scope disagreement halts fixes into a documentation PR. Recommendations: fuzzing, static/dynamic analysis, threat modeling and secure‑by‑default configs.
AI-written summary · about
chapters (20)
- 0:00Start
- 0:50CNCF SIG Security
- 2:13Security assessments
- 3:06assessment process
- 3:48CNCF security audits
- 6:01Who did the reviews?
- 7:42This is not a competition, it is a process
- 8:49Common themes
- 9:59CoreDNS most fun (critical) vuln
- 11:30Biggest takeaways
- 14:04NATS biggest takeaway
- 14:50The price of C is eternal vigilance
- 17:04Envoy biggest takeaway
- 18:16Does C++ suffer the same problems as C?
- 19:23TUF and Notary biggest takeaway
- 20:03OPA biggest takeaway
- 20:48OPA takeaway 2
- 22:21Extreme scope disagreement
- 23:15If you cannot agree scope, do not audit
- 26:27In summary...
related talks
41mManaging Audits for Critical Open Source Projects
34mCNCF SIG-Security Intro
25mThe State of Vulnerability in Cloud Native Security
17mA Sneak Peak Into Security Reviews with the Community
22mIntro: CNCF Security SIG
29mSecure Code Development and Lessons Learned from etcd Security Audit
30mSuccess Stories in Open Source: Security Audits with OSTIF
39mManaging Audits for Critical Open Source Projects