Keeping Up with the CVEs: How to Find a Needle in a Haystack?
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 17:25· Room 408 AB + Online·
summary
An internal image scan returns 314159 vulnerabilities, forcing a practical triage: ignore unfixed or irrelevant CVEs, prioritize only fixable CVEs in the code execution path, and score risk by threat model. Kubernetes reduces noisy findings by moving many component images to a distroless base, adding a small go wrapper (go-runner) and a static bash where needed, using an s-bomb utility and automated six‑hour scans to cut churn and dramatically lower actionable vulnerabilities.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:23Welcome
- 1:50Why is the graph looking like this
- 3:21Example
- 5:38Vulnerability Scanner
- 6:26Vulnerability Analysis
- 11:39Image Scanners
- 12:55Vulnerability Impact
- 13:36Kubernetes
- 15:20Release Engineering
- 16:42Kubernetes Enhancement Proposal
- 17:34Distroless
- 17:58Base
- 19:35Bash Static
- 20:09QProxy
- 21:00Not a perfect solution
- 21:12Container images are complex
- 21:47Imperfect solutions have benefits
- 22:30Reduce churn
- 22:51How Kubernetes maintainers feel
- 24:08Focus on code execution path
- 24:43Give engineers breathing space
- 25:55Create a list of images
- 26:24Automated jobs
- 29:46Questions
related talks
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
20mPrioritizing the Linux OS Hardening and CVE Mitigation
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
34mContainer Vulnerability Management in Kubernetes
35mWhy Isn't the Fix in My Container? Tracking CVE Propagation Across 10,000 Projects.
35mKeynote: How I learned to stop worrying and love CVEs