All news with #kubernetes security tag

🔒 Synacktiv disclosed an unpatched vulnerability in Argo CD's repo-server that allows unauthenticated attackers to execute arbitrary commands if they can reach the component's internal gRPC port. The flaw abuses kustomize's --helm-command option to run attacker-controlled scripts, demonstrated against Argo CD v2.13.3, and can lead to full cluster takeover by leveraging exposed Redis credentials. There is no fixed release or CVE; operators must enable Kubernetes network policies to isolate repo-server and Redis until a patch is available.

🔒 Today AWS announced container attribute-based rules for AWS Network Firewall, allowing firewall policies to reference native container constructs like Namespace, Cluster Name, Labels for Amazon EKS, and Cluster Name and Container Instance Attributes for Amazon ECS. This removes the need for fragile IP-based rules that break when pods scale or restart and supports generative AI and other dynamic workloads. The feature supports TLS decryption, FQDN and URL category filtering, and GeoIP controls, and is available at no extra cost in supported regions.

🛡️ The AWS CIRT updated the Threat Technique Catalog for June 2026, adding five new entries focused on container security, organization-level trust, and compute hijacking. The update documents EKS workload modification, exploitation of public-facing Kubernetes services, sts:AssumeRoot abuse across AWS Organizations, compute hijacking in clusters, and account invitations into attacker-controlled organizations. It also refreshes three existing entries with expanded detection and mitigation guidance.

🚀 GKE Inference Gateway uses prefix caching and model-aware routing to reduce accelerator idle time and speed up LLM inference. By matching request prefixes to pods that already hold the KV cache, it avoids repeated recomputation and lowers latency compared with naive round-robin load balancing. Independent benchmarks show 15.7% higher throughput, 92.8% faster time-to-first-token, and 62.6% lower inter-token latency. Snap reports 75–80% prefix cache hit rates in production integrations.

🛠️ App-centric maintenance visibility in Unified Maintenance shifts focus from infrastructure to business services. By integrating with App Hub, Unified Maintenance aggregates maintenance schedules for registered resources—GKE clusters, GCE VMs, AlloyDB instances—into a single application-aware dashboard. This reduces manual mapping, speeds triage of performance issues against planned updates, and helps platform teams predict operational impacts across many projects.

🔒 Kaspersky Container Security (KCS) is presented as a comprehensive platform that reaches beyond registry image scanning to secure container workflows across development and production. The Product Security Team uses KCS in CI/CD pipelines, registry correlation, and cluster runtime monitoring to tie findings to specific artifacts, pipelines, and scan times. KCS computes risk ratings, supports SBOM processing, and produces reports in SARIF, CycloneDX, SPDX and standard formats to integrate with AppSec and internal tooling.

🔁 Amazon EKS now supports Amazon Application Recovery Controller (ARC) zonal shift and zonal autoshift when using the open-source Karpenter for compute provisioning. ARC automates redirecting in-cluster network traffic away from an impaired AZ and can perform practice runs to validate cluster behavior. During a zonal shift, Karpenter stops provisioning in the impacted AZ, halts voluntary disruptions there, and avoids scheduling actions that depend on that zone. Enable support by setting ENABLE_ZONAL_SHIFT.

🔷 At Red Hat Summit 2026, Microsoft and Red Hat highlighted how Azure Red Hat OpenShift supports modernization and production AI by delivering consistent governance, security, and scale. Microsoft was named Platform Modernization Partner of the Year, underscoring joint customer outcomes. Banco Bradesco and Topicus illustrate production AI and regulated lending workloads running on the jointly managed platform. Key advances include OpenShift Virtualization, confidential containers, managed identities, expanded NVIDIA GPU support, and broader regional availability.

💾 Amazon EKS now supports the EC2 Instance Store CSI driver as an EKS add-on, and you can install and manage it via the EKS console or AWS CLI. The driver exposes ephemeral NVMe-based instance store volumes as Kubernetes persistent volumes and manages their lifecycle on EC2 hosts. This feature simplifies attaching local instance storage to EKS clusters and is available in all commercial regions.

🤖 Join hands-on developer workshops across North America that teach secure, scalable deployment of agentic AI for enterprises. These sessions are practical, bring-your-laptop labs where Platform, Security, and Data practitioners build end-to-end solutions, including GKE cluster hardening, secure sandboxing, and governed data pipelines. Tracks cover GKE + Data and Data Engineering & Analytics, with guidance from Google experts. Attendees leave with runnable labs and operational best practices to accelerate production adoption.

🚀Amazon EKS now supports Dynamic Resource Allocation (DRA) for Elastic Fabric Adapter (EFA), simplifying RDMA and high-performance inter-node communication for AI/ML and HPC workloads. The EFA DRA driver, based on the upstream DRANET project, enables topology-aware allocation and EFA interface sharing so network traffic uses the closest NIC to GPUs, Trainium, or Inferentia. It’s recommended for new EKS deployments on Kubernetes 1.34+ and is available in all AWS Regions; the existing EFA device plugin remains supported and is still recommended for use with Karpenter and Amazon EKS Auto Mode.

☁️ Amazon Elastic Kubernetes Service (EKS) now offers one-click cluster access from the AWS Management Console via AWS CloudShell, eliminating the need to install or configure kubectl, AWS CLI, or kubeconfig files locally. From the EKS console, selecting Connect launches a CloudShell session with kubectl pre-configured for the chosen cluster so you can run commands immediately. The feature supports clusters with both public and private API server endpoints and each session also includes the AWS CLI and standard CloudShell utilities for troubleshooting and management.

🚀 At Google Cloud Next ’26, Google unveiled a suite of GKE enhancements focused on large-scale AI and agentic workloads. Highlights include the new GKE Agent Sandbox (gVisor-based isolation for fast, secure sandboxes), private GA of GKE hypercluster to manage millions of accelerators across regions, and inference upgrades like Predictive Latency Boost and KV cache tiering. Preview RL features and intent-based autoscaling on custom metrics further enhance utilization and reliability.

🔗 Amazon Elastic Kubernetes Service (EKS) introduces the Amazon EKS Hybrid Nodes gateway to automate networking between an EKS cluster VPC and Kubernetes Pods running on EKS Hybrid Nodes. The gateway removes the need to make on‑premises pod networks routable and avoids extensive coordination with network teams by automatically maintaining VPC route tables as workloads scale. Deployed to Amazon EC2 instances via Helm, the gateway also enables control-plane-to-webhook, pod-to-pod, and AWS service connectivity (ALB, NLB, Amazon Managed Service for Prometheus). The codebase is open source and the feature is available in all Regions where EKS Hybrid Nodes is supported, excluding China Regions. AWS offers the gateway itself at no additional charge; customers pay for underlying EC2 and data transfer costs.

⚡ GKE’s Cloud Storage FUSE Profiles automate performance tuning for AI/ML workloads by providing pre-defined, dynamically managed StorageClasses optimized for training, serving, and checkpointing. Instead of manually adjusting many mount and CSI options, users select a profile and GKE scans the bucket and node resources to calculate cache sizes and backing media. The CSI driver mounts the volume with those calculated options and dynamically adjusts cache behavior using real-time signals to maximize throughput while protecting node stability.

🔒 Unit 42 details how widespread Kubernetes attacks—driven by identity theft and exposed services—enable escalation from containers into cloud backends. The report highlights stolen service account tokens and the rapid exploitation of React2Shell (CVE-2025-55182), showing how attackers extract mounted tokens and cloud credentials. Practical mitigations include strict RBAC, short-lived projected tokens, runtime telemetry, and API audit logging. Unit 42 maps these behaviors to MITRE ATT&CK and provides detection examples.

🔔 Amazon CloudWatch now offers Container Insights with OpenTelemetry metrics for Amazon EKS in public preview. The feature collects OTLP metrics from open source and AWS collectors, enriches each metric with up to 150 labels, and supplies curated dashboards and PromQL query support in CloudWatch Query Studio. Deployment is available via the CloudWatch Observability EKS add‑on, console, CloudFormation, CDK, or Terraform, and preview metrics are free.

🔒 Kubernetes clusters can be undermined by the very automation that makes them resilient. By registering or compromising a controller—most commonly via a MutatingWebhookConfiguration—an attacker can intercept pod-creation requests and inject a covert sidecar, turning the cluster’s control loop into a self-healing backdoor. These injections are often invisible to casual inspection, survive pod restarts and upgrades, and can be disguised under benign names. Teams should audit webhooks, monitor RoleBindings and OwnerReferences, and restrict webhook registration to reduce this risk.

🔧 Cloudflare engineers traced repeated 30-minute Atlantis restarts to Kubernetes recursively changing file ownership on a large PersistentVolume. The default pod securityContext behavior (fsGroup combined with fsGroupChangePolicy: Always) caused kubelet to run an expensive recursive chgrp across millions of files, creating a mounting bottleneck. By validating that file group ownership would remain stable and setting fsGroupChangePolicy: OnRootMismatch, restarts dropped to ~30 seconds. That single-line change recovered roughly 50 engineering hours per month (about 600 hours per year).

⚡ DRA (Dynamic Resource Allocation) modernizes Kubernetes device management by replacing static Device Plugins with a request-based model built on ResourceSlice and ResourceClaim. It enables granular, attribute-based requests such as minimum VRAM, specific hardware models, or PCIe locality, and abstracts hardware via DeviceClass so the scheduler can match workloads to suitable devices. NVIDIA contributed a GPU driver and Google donated a TPU driver, and DRA is generally available in GKE. This reduces manual node pinning and improves utilization for LLM and AI workloads.