Kubernetes Third Party Aud... Iain Smart, Amir Montazery, Rey Lejano, Tabitha Sable & Pietro Tirenna

This talk covers the recent third-party audit of Kubernetes, organized by SIG-Security-Audit in collaboration with the Open Source Technology Improvement Fund and conducted by Shielder. The speakers, including experts from AmberWolf, Red Hat, and Datadog, discuss the audit process, providing insights into planning, logistics, and experiences of open-source collaboration with vendors. They highlight the evolution of the audit approach, examining non-core components such as Cluster API, Konnectivity, and Image Builder, and present key findings, including supply chain risks, insecure design patterns, and unsafe defaults. This session offers valuable lessons for developers and security practitioners involved in the cloud-native community.