# \#security **URL:** https://discuss.kubernetes.io/tag/security/53.md [Latest](https://discuss.kubernetes.io/latest.md) · [Categories](https://discuss.kubernetes.io/categories.md) · [Tags](https://discuss.kubernetes.io/tags.md) --- ## [Why does ImageVolume require priveleged node access](https://discuss.kubernetes.io/t/why-does-imagevolume-require-priveleged-node-access/34950)
**Author:** [@zevisert](https://discuss.kubernetes.io/u/zevisert)\ **Replies:** 0\ **Last updated:** [July 22, 2026, 4:36pm UTC](https://discuss.kubernetes.io/t/why-does-imagevolume-require-priveleged-node-access/34950 "2026-07-22T16:36:53Z")
Hi everyone! First post here, and admittedly I haven’t really poured over the community guidelines, so apologies if I’m posting in the wrong space. I noticed that 1.36 enabled the new ImageVolume feature - I’m excited a… --- ## [Gateway API: A Deep Dive](https://discuss.kubernetes.io/t/gateway-api-a-deep-dive/34691)
**Author:** [@roma-glushko](https://discuss.kubernetes.io/u/roma-glushko)\ **Replies:** 0\ **Last updated:** [May 31, 2026, 2:06pm UTC](https://discuss.kubernetes.io/t/gateway-api-a-deep-dive/34691 "2026-05-31T14:06:21Z")
Hey Kubernetes folks :waving\_hand: I’ve published a deep dive into Gateway API. The blog post covers: how Kubernetes ingress patterns evolved from Service resources to Ingress and now Gateway API why the Ingress … --- ## [Privileged container in pod running in user namespace (KEP-127)](https://discuss.kubernetes.io/t/privileged-container-in-pod-running-in-user-namespace-kep-127/24185)
**Author:** [@a-rec](https://discuss.kubernetes.io/u/a-rec)\ **Replies:** 5\ **Last updated:** [May 1, 2026, 9:40pm UTC](https://discuss.kubernetes.io/t/privileged-container-in-pod-running-in-user-namespace-kep-127/24185 "2026-05-01T21:40:57Z")
TD;DR - Is it considered safe to have a privileged container in a pod that is running in its own user namespace? I’m using the hostUsers: false flag on a pod to run the pod in its own unprivileged user namespace. KEP-1… --- ## [Log references for k8s](https://discuss.kubernetes.io/t/log-references-for-k8s/34397)
**Author:** [@LiLShum](https://discuss.kubernetes.io/u/LiLShum)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 11:30am UTC](https://discuss.kubernetes.io/t/log-references-for-k8s/34397 "2026-04-07T11:30:40Z")
Hi, has anyone encountered the need to find a complete list of all Kubernetes logs? This requirement came up while building a monitoring system for a cybersecurity center, and I would like to find ready-made examples of … --- ## [Windows: Seeing intermittent DNS issues on k8s](https://discuss.kubernetes.io/t/windows-seeing-intermittent-dns-issues-on-k8s/34276)
**Author:** [@smandhada](https://discuss.kubernetes.io/u/smandhada)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 9:56am UTC](https://discuss.kubernetes.io/t/windows-seeing-intermittent-dns-issues-on-k8s/34276 "2026-03-12T09:56:13Z")
When operating in environments with high pod churn rates—where pods are frequently created and terminated—and multiple services are configured to reference a single deployment, we observed that network connectivity on so… --- ## [Does native sidecar containers support lifcycle prestop hooks](https://discuss.kubernetes.io/t/does-native-sidecar-containers-support-lifcycle-prestop-hooks/33901)
**Author:** [@ramesh569](https://discuss.kubernetes.io/u/ramesh569)\ **Replies:** 0\ **Last updated:** [January 2, 2026, 1:56pm UTC](https://discuss.kubernetes.io/t/does-native-sidecar-containers-support-lifcycle-prestop-hooks/33901 "2026-01-02T13:56:57Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: Kubernetes version:1.32. Cloud being used: AKS-Azure Installation method: IAC Host OS: Linux CNI and versio… --- ## [Kubernetes v1.33.6 / v1.34.x – Kernel 4.18 Compatibility on RHEL 8 while Addressing Kubelet RCE](https://discuss.kubernetes.io/t/kubernetes-v1-33-6-v1-34-x-kernel-4-18-compatibility-on-rhel-8-while-addressing-kubelet-rce/33851)
**Author:** [@Bangar](https://discuss.kubernetes.io/u/Bangar)\ **Replies:** 0\ **Last updated:** [December 23, 2025, 6:38am UTC](https://discuss.kubernetes.io/t/kubernetes-v1-33-6-v1-34-x-kernel-4-18-compatibility-on-rhel-8-while-addressing-kubelet-rce/33851 "2025-12-23T06:38:56Z")
Hello Everyone, I’m looking for guidance and confirmation regarding Kubernetes upgrade constraints on RHEL 8, specifically while trying to address a Kubelet RCE vulnerability. Cluster information Current Kubernetes v… --- ## [Kubernetes: How traffic flows from internet to container via Istio](https://discuss.kubernetes.io/t/kubernetes-how-traffic-flows-from-internet-to-container-via-istio/30259)
**Author:** [@jayeshmahajan](https://discuss.kubernetes.io/u/jayeshmahajan)\ **Replies:** 3\ **Last updated:** [December 9, 2025, 1:50am UTC](https://discuss.kubernetes.io/t/kubernetes-how-traffic-flows-from-internet-to-container-via-istio/30259 "2025-12-09T01:50:17Z")
Sharing from one of my recent article I wrote exploring how the traffic flow from internet to container via istio Let’s walk through the traffic flow from the internet to your application containers in GKE using Istio. … --- ## [Enabling SSL Passthrough](https://discuss.kubernetes.io/t/enabling-ssl-passthrough/16969)
**Author:** [@senfo](https://discuss.kubernetes.io/u/senfo)\ **Replies:** 2\ **Last updated:** [December 5, 2025, 10:14am UTC](https://discuss.kubernetes.io/t/enabling-ssl-passthrough/16969 "2025-12-05T10:14:54Z")
I am relatively new to Kubernetes, so please pardon me ahead of time for any terminology I might use incorrectly and/or any other fundamental misunderstandings I probably have. I need to be able to get access to the cli… --- ## [Network policies based on namespaces](https://discuss.kubernetes.io/t/network-policies-based-on-namespaces/33665)
**Author:** [@mkain](https://discuss.kubernetes.io/u/mkain)\ **Replies:** 1\ **Last updated:** [November 26, 2025, 6:25am UTC](https://discuss.kubernetes.io/t/network-policies-based-on-namespaces/33665 "2025-11-26T06:25:09Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: Kubernetes version: 1.33.5-1.1 Cloud being used: bare-metal Installation method: Host OS: Debian 13 CNI and… --- ## [Encrypted Client Hello (ECH) with Gateway API](https://discuss.kubernetes.io/t/encrypted-client-hello-ech-with-gateway-api/33527)
**Author:** [@fuero](https://discuss.kubernetes.io/u/fuero)\ **Replies:** 0\ **Last updated:** [November 3, 2025, 3:00pm UTC](https://discuss.kubernetes.io/t/encrypted-client-hello-ech-with-gateway-api/33527 "2025-11-03T15:00:13Z")
Hi, the gateway API docs (and ingress API docs) don’t mention how or if \[encrypted client hello (ECH)\]( draft-ietf-tls-esni-25 - TLS Encrypted Client Hello ) support is handled. The k8s docs only refer to SNI in the in… --- ## [Dell quietly made their CSI drivers closed-source. Are we okay with the security implications of this?](https://discuss.kubernetes.io/t/dell-quietly-made-their-csi-drivers-closed-source-are-we-okay-with-the-security-implications-of-this/33362)
**Author:** [@ninth9ste](https://discuss.kubernetes.io/u/ninth9ste)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 3:16pm UTC](https://discuss.kubernetes.io/t/dell-quietly-made-their-csi-drivers-closed-source-are-we-okay-with-the-security-implications-of-this/33362 "2025-10-06T15:16:17Z")
So, I stumbled upon something a few weeks ago that has been bothering me, and I haven’t seen much discussion about it. Dell seems to have quietly pulled the source code for their CSI drivers (PowerStore, PowerFlex, Power… --- ## [Tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead](https://discuss.kubernetes.io/t/tls-failed-to-verify-certificate-x509-certificate-relies-on-legacy-common-name-field-use-sans-instead/32458)
**Author:** [@joseccz](https://discuss.kubernetes.io/u/joseccz)\ **Replies:** 0\ **Last updated:** [May 30, 2025, 1:21pm UTC](https://discuss.kubernetes.io/t/tls-failed-to-verify-certificate-x509-certificate-relies-on-legacy-common-name-field-use-sans-instead/32458 "2025-05-30T13:21:41Z")
I have a docker registry using self signed certificates. While trying to download an image using my kb8 yaml file I get the error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field,… --- ## [Not able to authenticate Dashboard with oauth and Google](https://discuss.kubernetes.io/t/not-able-to-authenticate-dashboard-with-oauth-and-google/30525)
**Author:** [@mcfdez](https://discuss.kubernetes.io/u/mcfdez)\ **Replies:** 3\ **Last updated:** [May 15, 2025, 12:07pm UTC](https://discuss.kubernetes.io/t/not-able-to-authenticate-dashboard-with-oauth-and-google/30525 "2025-05-15T12:07:54Z")
Hello, I have configured the oauth-proxy component with the Google provider to protect certain applications in my cluster and that they are only accessible if we use this authentication system, among them, the Kubernete… --- ## [Kubelet\_pod\_pids\_limit and LimitMEMLOCK in kubelet configuration for production cluster](https://discuss.kubernetes.io/t/kubelet-pod-pids-limit-and-limitmemlock-in-kubelet-configuration-for-production-cluster/32279)
**Author:** [@Anusha\_Ruwanpathiran](https://discuss.kubernetes.io/u/Anusha_Ruwanpathiran)\ **Replies:** 0\ **Last updated:** [May 7, 2025, 2:21pm UTC](https://discuss.kubernetes.io/t/kubelet-pod-pids-limit-and-limitmemlock-in-kubelet-configuration-for-production-cluster/32279 "2025-05-07T14:21:45Z")
We are finalizing security configurations for our production Kubernetes cluster and would appreciate your review of the following proposed kubelet settings: Proposed Configuration PID Limits pod\_pids\_limit: -1 (Unlim… --- ## [Best place to ask about CVE related questions?](https://discuss.kubernetes.io/t/best-place-to-ask-about-cve-related-questions/31857)
**Author:** [@buckaroogeek](https://discuss.kubernetes.io/u/buckaroogeek)\ **Replies:** 1\ **Last updated:** [March 13, 2025, 11:29pm UTC](https://discuss.kubernetes.io/t/best-place-to-ask-about-cve-related-questions/31857 "2025-03-13T23:29:04Z")
I help maintain Kubernetes packages for Fedora repositories. I will sometimes get CVE related bugs that might affect Kubernetes directly. Where would be the best place to ask if a specific CVE applies to Kubernetes? tha… --- ## [Run a linux process with securityContext applied](https://discuss.kubernetes.io/t/run-a-linux-process-with-securitycontext-applied/31694)
**Author:** [@AbhishekBorah](https://discuss.kubernetes.io/u/AbhishekBorah)\ **Replies:** 0\ **Last updated:** [February 26, 2025, 7:23am UTC](https://discuss.kubernetes.io/t/run-a-linux-process-with-securitycontext-applied/31694 "2025-02-26T07:23:51Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: Kubernetes version: 1.30.0 Cloud being used: Azure Installation method: ARM template Host OS: Ubuntu Linux … --- ## [Do These CVEs Really Matter for kube-proxy?](https://discuss.kubernetes.io/t/do-these-cves-really-matter-for-kube-proxy/31635)
**Author:** [@justkugi](https://discuss.kubernetes.io/u/justkugi)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 7:07am UTC](https://discuss.kubernetes.io/t/do-these-cves-really-matter-for-kube-proxy/31635 "2025-02-19T07:07:24Z")
Hello everyone, I am a beginner in Kubernetes and recently performed a security scan on the image registry.k8s.io/kube-proxy:1.29.14. The scan identified the following high-risk CVEs: CVE-2020-36325 CVE-2012-2663 Sin… --- ## [We have migrated kubernetes VMs from AWS to Azure,and after the migration we are seeing calico and coredns pods are in unknow state. Could someone please post your suggestions](https://discuss.kubernetes.io/t/we-have-migrated-kubernetes-vms-from-aws-to-azure-and-after-the-migration-we-are-seeing-calico-and-coredns-pods-are-in-unknow-state-could-someone-please-post-your-suggestions/31495)
**Author:** [@vampuhem](https://discuss.kubernetes.io/u/vampuhem)\ **Replies:** 2\ **Last updated:** [February 10, 2025, 3:21am UTC](https://discuss.kubernetes.io/t/we-have-migrated-kubernetes-vms-from-aws-to-azure-and-after-the-migration-we-are-seeing-calico-and-coredns-pods-are-in-unknow-state-could-someone-please-post-your-suggestions/31495 "2025-02-10T03:21:47Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: Kubernetes version:v1.30.8 Cloud being used: (put bare-metal if not on a public cloud) Installation method: … --- ## [Add Iptables rule to the Kubernetes nodes](https://discuss.kubernetes.io/t/add-iptables-rule-to-the-kubernetes-nodes/21190)
**Author:** [@Hamed\_Bs](https://discuss.kubernetes.io/u/Hamed_Bs)\ **Replies:** 2\ **Last updated:** [February 9, 2025, 9:22pm UTC](https://discuss.kubernetes.io/t/add-iptables-rule-to-the-kubernetes-nodes/21190 "2025-02-09T21:22:08Z")
I am trying to restrict SSH to my kubernetes nodes by adding some iptables rules, but it seems that iptables rules are managed by kube-proxy. In my test after adding some rules to the INPUT chain, rules were gone after n… --- ## [Ok to directly replace CA rather than rotation CA for K8S?](https://discuss.kubernetes.io/t/ok-to-directly-replace-ca-rather-than-rotation-ca-for-k8s/31256)
**Author:** [@wyz159753](https://discuss.kubernetes.io/u/wyz159753)\ **Replies:** 0\ **Last updated:** [January 15, 2025, 8:45am UTC](https://discuss.kubernetes.io/t/ok-to-directly-replace-ca-rather-than-rotation-ca-for-k8s/31256 "2025-01-15T08:45:46Z")
I know there is a manual rotation flow to rotate CA for K8S (Manual Rotation of CA Certificates | Kubernetes), it first rotate to bundled CA and then to new CA, the benefit is it can guarantee the cluster is working duri… --- ## [Open an openvpn client into Pod](https://discuss.kubernetes.io/t/open-an-openvpn-client-into-pod/30772)
**Author:** [@Julien](https://discuss.kubernetes.io/u/Julien)\ **Replies:** 0\ **Last updated:** [December 11, 2024, 11:23am UTC](https://discuss.kubernetes.io/t/open-an-openvpn-client-into-pod/30772 "2024-12-11T11:23:01Z")
Hello, I’m relatively new to networking and Kubernetes, but I need to perform a load test on an OpenVPN server. Here’s what I’ve done so far: I created a Docker image that includes an OpenVPN client. I set up a Kuber… --- ## [Kubernetes integration into Windows AD CS](https://discuss.kubernetes.io/t/kubernetes-integration-into-windows-ad-cs/30729)
**Author:** [@BillClarksonAntill](https://discuss.kubernetes.io/u/BillClarksonAntill)\ **Replies:** 0\ **Last updated:** [December 6, 2024, 2:42am UTC](https://discuss.kubernetes.io/t/kubernetes-integration-into-windows-ad-cs/30729 "2024-12-06T02:42:23Z")
Hey All, Just wondering if its possible to integrate Windows AD CS into Kubernetes for all certificates? and how could it be done? Regards Bill --- ## [Vulnerabilities in Go dependencies: otelgrpc, otelhttp](https://discuss.kubernetes.io/t/vulnerabilities-in-go-dependencies-otelgrpc-otelhttp/30642)
**Author:** [@kartkaru-orcl](https://discuss.kubernetes.io/u/kartkaru-orcl)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 6:10am UTC](https://discuss.kubernetes.io/t/vulnerabilities-in-go-dependencies-otelgrpc-otelhttp/30642 "2024-11-27T06:10:44Z")
Asking for help? Comment out what you need so we can get more information to help you! We are using the release kubernetes-1.28.15 for our cluster. We are flagged for the below vulnerabilities in kube-scheduler. Advis… --- ## [Manually created ServiceAccount tokens "expiring" unexpectedly](https://discuss.kubernetes.io/t/manually-created-serviceaccount-tokens-expiring-unexpectedly/30330)
**Author:** [@seojeung.h](https://discuss.kubernetes.io/u/seojeung.h)\ **Replies:** 1\ **Last updated:** [October 31, 2024, 8:44am UTC](https://discuss.kubernetes.io/t/manually-created-serviceaccount-tokens-expiring-unexpectedly/30330 "2024-10-31T08:44:46Z")
Cluster information: Kubernetes version: Client Version: v1.29.9-dbx2 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.29.9-dbx2 Cloud being used: bare-metal Installation method: hand-rolled … --- ## [Waiting for the API server to be healthy couldn't initialize a Kubernetes cluster](https://discuss.kubernetes.io/t/waiting-for-the-api-server-to-be-healthy-couldnt-initialize-a-kubernetes-cluster/29446)
**Author:** [@IVK-Lucio](https://discuss.kubernetes.io/u/IVK-Lucio)\ **Replies:** 3\ **Last updated:** [October 23, 2024, 9:44am UTC](https://discuss.kubernetes.io/t/waiting-for-the-api-server-to-be-healthy-couldnt-initialize-a-kubernetes-cluster/29446 "2024-10-23T09:44:06Z")
Asking for help? Comment out what you need so we can get more information to help you! I am setting up a kudeadm on rhel8 vms on prem using ansible playbooks, however, when i run the kube init am getting the following e… --- ## [Relation of Mounting NFS shares in Pod and serviceaccounts in Kubernetes](https://discuss.kubernetes.io/t/relation-of-mounting-nfs-shares-in-pod-and-serviceaccounts-in-kubernetes/30121)
**Author:** [@vij](https://discuss.kubernetes.io/u/vij)\ **Replies:** 0\ **Last updated:** [October 14, 2024, 4:39pm UTC](https://discuss.kubernetes.io/t/relation-of-mounting-nfs-shares-in-pod-and-serviceaccounts-in-kubernetes/30121 "2024-10-14T16:39:50Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: Kubernetes version: 1.25 Cloud being used: (put bare-metal if not on a public cloud) : Bare Metal Installati… --- ## [Decrypt all K8s traffic](https://discuss.kubernetes.io/t/decrypt-all-k8s-traffic/29963)
**Author:** [@EnriqueK8s](https://discuss.kubernetes.io/u/EnriqueK8s)\ **Replies:** 0\ **Last updated:** [October 1, 2024, 9:40am UTC](https://discuss.kubernetes.io/t/decrypt-all-k8s-traffic/29963 "2024-10-01T09:40:28Z")
Hello Kubernetes Community, I am currently working on a project where I need to analyse the internal traffic within a single-node Kubernetes cluster, specifically at the packet level. My goal is to monitor the traffic b… --- ## [Automation for DNS and Connection Check by using APIs at k8s layer](https://discuss.kubernetes.io/t/automation-for-dns-and-connection-check-by-using-apis-at-k8s-layer/29829)
**Author:** [@jayeshmahajan](https://discuss.kubernetes.io/u/jayeshmahajan)\ **Replies:** 1\ **Last updated:** [September 22, 2024, 7:33pm UTC](https://discuss.kubernetes.io/t/automation-for-dns-and-connection-check-by-using-apis-at-k8s-layer/29829 "2024-09-22T19:33:59Z")
In my experience here and while working in different organization due to compliance, trust, team structure the permissions to network layer devices as well as for k8s admin the permissions are restricted. Developer do no… --- ## [Can not add ephemeralContainers according to kubectl patch](https://discuss.kubernetes.io/t/can-not-add-ephemeralcontainers-according-to-kubectl-patch/29764)
**Author:** [@13567436138](https://discuss.kubernetes.io/u/13567436138)\ **Replies:** 0\ **Last updated:** [September 16, 2024, 4:53am UTC](https://discuss.kubernetes.io/t/can-not-add-ephemeralcontainers-according-to-kubectl-patch/29764 "2024-09-16T04:53:18Z")
Asking for help? Comment out what you need so we can get more information to help you! Cluster information: root@k8s-master01:~# kubectl patch deployment nginx -n default --type=‘json’ -p=‘\[{“op”: “add”, “path”: “/spec/… [Next page](https://discuss.kubernetes.io/tag/security/53.md?match_all_tags=true&page=1&tags%5B%5D=security)