Much like the Western frontier where lawmen circulated “wanted” posters offering monetary bounties for outlaws, a handful of Kubernetes folks have put up funds for a Kubernetes bug bounty program. This group of lawmen include the Cloud Native Computing Foundation (CNCF) and its Kubernetes Product Security Committee, HackerOne, and Google.

The program comes on the heels of Kubernetes' ongoing rampage across the cloud market. That rampage has brought ongoing security challenges and a need for guidance. Google, which initially handed over the Kubernetes reigns to CNCF in 2014, proposed launching an official bug bounty program at the beginning of 2018. Those efforts were targeted at attracting security researchers to comb over code, squash security bugs, and invest in Kubernetes security guarantees.

Though this isn’t a new approach for Google, who had previously established its own Vulnerability Rewards Program (VRP) to reward vulnerabilities reported in Google Kubernetes Engine (GKE) along with the vast majority of all other Google Cloud services, a bug bounty program for an open-source infrastructure tool is a relatively novel kind of blueprint.

The Kubernetes program is similar to the Internet Bug Bounty, which covers core components that are consistently deployed across environments. Kubernetes’ program differs in coverage, targeting the location where most bug bounties are hosted: web apps. 

“We realize that security is a critical part of any user’s decision to use an open-source tool, so we dedicate resources to help ensure we’re providing the best possible security for Kubernetes and GKE,” explained Maya Kaczorowski, product manager for container security at Google Cloud, in a blog post announcing the program.

CNCF ponied up funds for the initiative through its Kubernetes Product Security Committee. It's also working with bug bounty program vendor HackerOne, who was selected after winning a community-led RFP for the role. 

As part of the bootstrapping process, HackerOne refined the draft of components in scope  based on insight gleaned from the first Kubernetes Security Audit and had its team pass the Certified Kubernetes Administrator (CKA) exam to host the program. The program then spent several months in private release where researchers were invited to submit bugs to test the triage process.

“We hope to attract additional security researchers who may not be familiar with cloud-native technologies like Kubernetes to get involved and find vulnerabilities in this project,” Kaczorowski and Tim Allclair, who is a software engineer at Google Cloud, in an email to SDxCentral.

Bug bounties have become a fast track to big time cash for hackers. Last year, HackerOne reported that six individual hackers had become millionaires from bug bounties. 

And depending on the severity of the discovered Kubernetes vulnerability, hackers could score some serious cash as reported bounty rewards range from $100 to $10,000 each. That return is determined by a vulnerability taxonomy publicly published in Kubernetes documentation. To keep it simple, most content considered to be "core" Kubernetes is in scope, such as code from the main Kubernetes organizations on GitHub, continuous integration, release, and documentation artifacts. 

Once a report has been filed, HackerOne will handle the initial triage and assessments to scale the volume of validated reports for the Kubernetes security experts to handle. The Kubernetes’ Product Security Committee, comprised of security-focused Google, Shopify, and Red Hat employees, will then follow the documented security vulnerability response process, which includes assessing impact, generating, and rolling out a fix.

And while it is common practice for bug hunters to concentrate on one type of vulnerability or bug until they become experts in finding it, Kaczorowski and Allclair made it clear that there is a seat for every and any type of bug hunter at the table.

“We would like to see any and all security vulnerabilities in Kubernetes reported," they wrote. "The kinds of vulnerabilities that we're most interested in are common security issues like remote code execution and privilege escalation. Since Kubernetes is an open source project and anyone can contribute code we’re also interested in the Kubernetes supply chain, including build and release processes that might allow a malicious individual to affect build artifacts." 

Further, researchers don’t need to use the bug bounty to report a bug as they can still follow the existing process.

Kubernetes has garnered about 24,000 total contributors, 148,000 code commits, 83,000 pull requests, and 1.1 million total contributions since being adopted by CNCF. “It is the second- or third-highest velocity open source project depending on how you count it — up there with Linux and React,” explained CNCF Executive Director Dan Kohn in an interview.

That growth has garnered an increased focus on platform security. Last year was punctuated by a rash of security flaws that were further underscored by the first Kubernetes security audit hosted by CNCF and conducted by Trail of Bits and Atredis Partners. That internal look found 37 vulnerability issues with the 1.13.4 iteration of Kubernetes. These included five high-severity issues and 17 medium-severity issues. The overall size and operational complexity of Kubernetes was cited as being a key reason for these security holes.

Though the community itself has repeatedly stated that such flaws are to be expected and that the main focus should be on how quickly it can send out updates, this feeds into what remains one of the biggest concerns for enterprises that want to drive Kubernetes deeper into their operations: security.