Mitigation Strategies for Select Kubelet CVEs: Enhancing Security in Kubernetes Container Orchestration

Abstract

Common Vulnerabilities and Exposures (CVE) are used a standard structure to identify and catalog security related flaws which are disclosed publicly. These noticed CVE's serve as references to systematically track them, prioritize based on criticality and address the noticed vulnerabilities. The kubelet component is an important pillar in Kubernetes functionality which runs as a primary node agent responsible to control and manage the containerized application workloads across the cluster. The primary tasks of this agent are to facilitate the inter-communication between control plan node and worker nodes, managing the pod lifecycle from create-destroy, actively monitoring the node health and manage resource related allocations. This paper provides a detailed analysis of three critical kubelet related vulnerabilities, subsequently provides mitigation recommendations and implementable solutions to address each of the discussed vulnerabilities to effectively address the risks tied to these vulnerabilities.