Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more cross reference links to the Security items in the release notes #1410

Merged
merged 3 commits into from
Feb 1, 2024
Merged

Add more cross reference links to the Security items in the release notes #1410

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
75f43b5
Link to HTTPS metrics documentation
wallrj Feb 1, 2024
f612faf
Link to readOnlyRootFilesystem reference
wallrj Feb 1, 2024
a846527
Link to the CNCF graduation checklist which mentions the security audit
wallrj Feb 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions content/docs/releases/release-notes/release-notes-1.14.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,14 +43,14 @@ To know more details on name constraints check out RFC section https://datatrack

#### Security

An ongoing security audit of the cert-manager code revealed some weaknesses which we have addressed in this release,
An [ongoing CNCF security audit of the cert-manager code](https://github.com/cert-manager/cert-manager/issues/6132) revealed some weaknesses which we have addressed in this release,
such as using more secure default settings in the HTTP servers that serve metrics, healthz and pprof endpoints.
This will help mitigate denial-of-service attacks against those important services.

All the cert-manager containers are now configured with read only root file system by default,
All the cert-manager containers are now configured with [read only root file system](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) by default,
to prevent unexpected changes to the file system of the OCI image.

And it is now possible to configure the metrics server to use HTTPS rather than HTTP,
And it is now possible to [configure the metrics server to use HTTPS](../../devops-tips/prometheus-metrics.md#tls) rather than HTTP,
so that clients can verify the identity of the metrics server.

#### Other
Expand Down
Loading