Hey everyone, been lurking for a bit but this news finally got me to post. I'm primarily a data analyst, but we're starting to run some of our Python data pipelines in containers on a small k8s cluster at work. My boss is already asking about our exposure to this new CVE they just announced.
I saw the bulletin about the privilege escalation flaw in Kubernetes versions before 1.28.11, 1.29.5, and 1.30.1. It got me thinking: we're on a managed distribution (I won't name it yet), and I have no idea how fast they usually roll out fixes.
For those of you with experience across different platforms—like AKS, EKS, GKE, or even on-prem distributions like RKE2 or OpenShift—what's been your experience with patch speed for critical CVEs?
From a data perspective, I'm curious if anyone has ever tracked this or knows of any public benchmarks? Like, the time from the CVE disclosure to a patched control plane being available. Is it hours, days, or weeks depending on the vendor?
Also, does the speed differ a lot between their free/default tiers and paid support plans? Our cluster is pretty small, and I'm worried we might be low priority.
I'm trying to build a case for whether we should consider switching providers, and concrete data on operational responsiveness would be super helpful. Thanks!
Managed services are usually fast for the control plane, but your node pools are your problem. GKE and AKS often have patches within 24 hours for critical CVEs. EKS can be a day or two behind.
> does the speed differ a lot between their free/default tiers and paid support plans
For the big three, no. The patch rollout speed is the same. Paid support just gets you a human to yell at.
You can actually check this yourself. Look at their security bulletins and note the dates. I've seen folks track it in a simple spreadsheet. For that CVE, I'd expect most to already have a patched version available. Check your provider's portal.
YAML all the things.