Re: Security policies for Kubernetes

Brian Grant


If you have feedback on the kubernetes proposal, please do provide that feedback on the doc or on the issue.

On Thu, Nov 10, 2016 at 10:05 AM, Nicko van Someren via cncf-toc <cncf-toc@...> wrote:
Hi Alexis,

Thanks for that. I read through the Google Doc and added some comments.

One thing I think would be valuable to include in the security process is for there to be a broadcast mail to some 'announce' mailing list in advance of patches to high severity issues, indicating that a critical patch is imminent, with an expected release date but without full details of the issue. For large users with big IT infrastructure it may be necessary to schedule extra staff to install urgent patches quickly and having advanced notice of when this will be necessary is very helpful. Projects like OpenSSL usually send these out three days before security-critical releases (seeĀ for examples).


On Thu, Nov 10, 2016 at 10:26 AM, Alexis Richardson <alexis@...> wrote:

On Thu, Nov 10, 2016 at 5:21 PM, Dan Kohn via cncf-toc <cncf-toc@...> wrote:
There was a question at the Kubernetes panel Monday night about how to handle security reports now that Kubernetes is a CNCF rather than a Google project.

Brandon Phillips seems to have already gotten a good start on this at and in the linked Google Doc.

I presume he and Sarah Novotny will let CNCF staff know if they want any CNCF-hosted mailing lists or other infrastructure.

But I wanted to flag this publicly in case anyone on the TOC list wanted to chime in. I'm also cc'ing Greg KH, in case he might want to add any comments about the kernel security process.
Dan Kohn <mailto:dan@...g>
Executive Director, Cloud Native Computing Foundation <>

cncf-toc mailing list

Nicko van Someren
CTO, Linux Foundation

cncf-toc mailing list

Join to automatically receive all group messages.