The State of Kubernetes Policy and Governance

January, 2024

Hello, from all of us at Nirmata!

This new year, we bring you our exclusive January newsletter with the latest insights, news, and updates on Kubernetes, cloud-native security, compliance and governance from across the industry. From Kubernetes security, compliance, Policy as Code, to pipelines and supply chain security, we cover it all. Please feel free to reach-out to us to share your feedback or say hello!

Also, we are thrilled to announce that we've given our website a fresh new look and added some exciting features to enhance your experience! Head over to our New Website to explore the changes and see what's been added and improved! 

Preventing “Sys:All” vulnerability by using Kyverno policy

A critical vulnerability was discovered in Google Kubernetes Engine (GKE) that could allow attackers to take control of a Kubernetes cluster. The vulnerability is called “Sys:All” and is caused by a misunderstanding of the “system:authenticated” group.To protect your clusters, you can use the Kyverno policy that restricts the use of the groups necessary to exploit “Sys:All.” Read more. 

Recent Blogs

• In this blog post, Jim Bugwadia explained how policy-based resource management can be complementary to GitOps, what benefits it provides, and how to use Kyverno to mutate and generate rules with popular GitOps tools like Flux and ArgoCD. Read more here.

• The success of Nirmata's migration to ARM processors reinforces the importance of staying abreast of advancements in technology. We invite you to embrace this paradigm shift and unlock the potential benefits it may bring to your infrastructure. More details. 
• Using nctl to enforce security in CI/CD pipelines.

Download Free ebook

Unveiling our latest Policy-as-code ebook on Kubernetes. Dive deep into the nuances of Kubernetes policy governance, and discover best practices for managing policies effectively. Download here. 

Recent Events

• Charles-Edouard Breteche, Staff Engineer at Nirmata and also a maintainer for Kyverno discussed How to automate Kubernetes security with policy-as-code. 
• JimBugwadia talked about Kubernetes-native policy management with Kyverno, no-code policy with Kyverno, and signing and verifying container images with Sigstore Cosign and Kyverno. 
• An interesting discussion between Selvi Radhakrishna Cherian, Co-host of the Founder's podcast, and Jim Bugwadia, CEO and Co-founder of Nirmata, on the Future of cloud security and go-to-market strategies! 

Recent Videos

• Delve into the fascinating realm of Kyverno security rules, and explore the crucial role these rules play in safeguarding your systems and applications.
• By leveraging #kyverno, organizations can benefit from improved #kubernetes management, enhanced #security, and simplified policy enforcement, ultimately leading to more efficient and compliant Kubernetes environments. Watch the video here. 
• In this tutorial, Anais Urlichs explains how to combine three amazing security tools: #Trivy, #Cosign and #Kyverno.

From the Kyverno Community

Kyverno Blogs

• Deep dive with Thomas Segura and learn What long-lived service account tokens are, their uses, the risks they pose, and how they can be exploited. 
• Explore the DryRun capability of ProjectSveltos with Eleni Grosdouli, and learn how to Use #Kyverno policies in the process.
• Great blog by Chip Zoller where he explains how organizations can use two best-in-class tools, Kubecost for cost visibility and monitoring, and Kyverno for policy-as-code, to realize some massive savings.

Community Engagement

• 4.8k stars for Kyverno
• Over 2.74 Billion image pulls for Kyverno
• Growth in Kyverno adoption
• Latest Kyverno adopters
• New version of Kyverno Chainsaw
• Kyverno debuts at 32 in the Top 100 security List

We love hearing from you!

Are you already using Kyverno or planning to use Kyverno for security, governance and compliance of your Kubernetes environments? Are you looking to solve complex problems such as multi-tenancy, software supply chain security or developer self-service?  Contact us to learn how we can help.