You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+16Lines changed: 16 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -71,6 +71,22 @@ Active voice is preferred in most writing examples. Ex., "this ClusterPolicy mut
71
71
72
72
* We standardize on use of the Oxford comma.
73
73
74
+
### Links
75
+
76
+
In order to ensure that broken link detection works optimally as well as providing a way for users to find linked content when viewing the raw Markdown files on GitHub, links should be made using **relative paths to files** and not relative rendered paths. Following this method ensures not only pages can be found but anchor links are still valid.
77
+
78
+
This is a good link:
79
+
80
+
```
81
+
[some link text](foo.md#my-anchor)
82
+
```
83
+
84
+
This is a bad link:
85
+
86
+
```
87
+
[some link text](/docs/foo/#my-anchor)
88
+
```
89
+
74
90
## Documentation Versioning
75
91
76
92
The Kyverno website now uses releases to organize documentation by the specified release making it easier for users to find the information that pertains to their version. Releases are defined by branches of kyverno/website and a combination of exposing them in the website configuration and modifying hosting parameters.
Copy file name to clipboardExpand all lines: content/en/blog/general/2023-security-audit/index.md
+10-8Lines changed: 10 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,18 +8,19 @@ description: "Presenting the results from the Kyverno security audit"
8
8
The Kyverno project is pleased to announce the completion of its third-party security audit. The audit was conducted by [Ada Logics](https://adalogics.com) in collaboration with the Kyverno maintainers, the [Open Source Technology Improvement Fund](https://ostif.org) and was funded by the [Cloud Native Computing Foundation](https://www.cncf.io).
9
9
10
10
The audit was a holistic security audit with four goals:
11
+
11
12
1. Define a formal threat model for Kyverno.
12
13
2. Conduct a manual code audit for security vulnerabilities.
13
-
3. Assess Kyverno’s fuzzing suite against the threat model.
14
-
4. Evaluate Kyvernos supply-chain risks against SLSA.
14
+
3. Assess Kyverno's fuzzing suite against the threat model.
15
+
4. Evaluate Kyverno's supply-chain risks against SLSA.
15
16
16
-
Ada Logics found 10 security issues during the manual code auditing goal. Four of these had their root cause in the Notary verifier which had not been released prior to the audit. One of the findings was in a third-party dependency to Kyverno and was fixed by the Cosign project maintainers.
17
+
Ada Logics found 10 security issues during the manual code auditing goal. Four of these had their root cause in the Notary verifier which had not been released prior to the audit. One of the findings was in a third-party dependency to Kyverno and was fixed by the Cosign project maintainers.
17
18
18
-
In total, 6 CVE’s were assigned during the audit for the following components:
19
+
In total, 6 CVEs were assigned during the audit for the following components:
@@ -28,13 +29,14 @@ In total, 6 CVE’s were assigned during the audit for the following components:
28
29
29
30
Users consuming Kyverno from official releases have not been affected by the four CVE’s in the Notary verifier, since the Notary verifier has never been part of a public release, before Ada Logics reported the findings during the security audit. Only users building Kyverno from the main branch would be affected by these, however, building from main is highly discouraged.
30
31
31
-
During the fuzzing goal of the audit, Ada Logics wrote three new fuzzers and added them to Kyvernos fuzzing suite; Earlier this year, Kyverno completed its dedicated fuzzing security audit during which Ada Logics integrated Kyverno into OSS-Fuzz and built a fuzzing suite focusing on hitting high-coverage entry points. During the current security audit, Ada Logics wrote two fuzzers specifically for policy enforcement that attempt to create admission requests that are able to bypass Kyverno policies. In addition, Ada Logics wrote a fuzzer for a third-party dependency that implements complex data processing routines. The two policy fuzzers did not find any possible policy bypasses; the fuzzer for the third-party dependency found two reliability bugs.
32
+
During the fuzzing goal of the audit, Ada Logics wrote three new fuzzers and added them to Kyverno's fuzzing suite; Earlier this year, Kyverno completed its dedicated fuzzing security audit during which Ada Logics integrated Kyverno into OSS-Fuzz and built a fuzzing suite focusing on hitting high-coverage entry points. During the current security audit, Ada Logics wrote two fuzzers specifically for policy enforcement that attempt to create admission requests that are able to bypass Kyverno policies. In addition, Ada Logics wrote a fuzzer for a third-party dependency that implements complex data processing routines. The two policy fuzzers did not find any possible policy bypasses; the fuzzer for the third-party dependency found two reliability bugs.
32
33
33
-
During the SLSA goal, the auditors found that Kyverno impressively complies with the highest possible SLSA score and thereby ensures tamper-proof artifacts to consumers. Kyverno adopts the [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) which ensures SLSA level 3 compliance by generating verifiable provenance alongside releases on GitHub actions. Consumers can verify Kyvernos provenance by using the [slsa-verifier](https://github.com/slsa-framework/slsa-verifier).
34
+
During the SLSA goal, the auditors found that Kyverno impressively complies with the highest possible SLSA score and thereby ensures tamper-proof artifacts to consumers. Kyverno adopts the [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) which ensures SLSA level 3 compliance by generating verifiable provenance alongside releases on GitHub actions. Consumers can verify Kyverno's provenance by using the [slsa-verifier](https://github.com/slsa-framework/slsa-verifier).
34
35
35
36
The Kyverno maintainers have quickly addressed all issues found during the audit, with fixes incorporated in Kyverno v1.10.6 and v1.11.1. By prioritizing security work, the Kyverno team aims to provide a seamless and secure experience for consumers. Kyverno will continue to invest in robust security measures, staying ahead of potential threats and vulnerabilities.
36
37
37
38
Security researchers interested in contributing to Kyverno can find information about getting started [here](https://github.com/kyverno/kyverno/blob/main/SECURITY.md) or [engage with the Kyverno community](https://kyverno.io/community).
Copy file name to clipboardExpand all lines: content/en/blog/general/CVE-2022-47633/index.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,7 +28,7 @@ Prior to the December 14th disclosure, Ben had been in contact with the Kyverno
28
28
Checking image signatures is a good starting point but not a complete solution to securing the software supply chain. Additional policies should be used to:
29
29
30
30
* Require that only trusted registries are used ([sample policy](/policies/best-practices/restrict_image_registries/restrict_image_registries/)).
31
-
* Ensure attestations (i.e. signed metadata) are checked for provenance and other image attributes ([docs](/docs/writing-policies/verify-images/#verifying-image-attestations)).
31
+
* Ensure attestations (i.e. signed metadata) are checked for provenance and other image attributes ([docs](../../../docs/writing-policies/verify-images/sigstore/_index.md#verifying-image-attestations)).
32
32
33
33
Requiring trusted registries would prevent this attack, as users cannot use the malicious proxy or other untrusted registries.
0 commit comments