Patch Note for CTE for Kubernetes

Verify that the CTE for Kubernetes Container Image Fingerprint matches the version that you are installing:

New Features and Enhancements

• Support for Kubernetes Operator

  The CTE for Kubernetes Operator can deploy, monitor, upgrade and delete CTE for Kubernetes. When the CTE for Kubernetes Operator is deployed, its controller deploys the CTE for Kubernetes driver on the OpenShift cluster in the kube-system namespace. The manifests required to deploy the CTE-K8s driver are bundled with the operator.

  See Introduction to the Kubernetes Operator for more information.

Resolved Issues

• AGT-44903 [CS1431227]: Error: Access check returned 2

  This issue was caused by a file that was opened and using writeback. If the process (or thread) which opened the file has exited, then CTE is unable to find any process associated with the IO. In this specific case, CTE was only able to use the original UID/GID from the opening thread, and was not able to calculate any group name, process name or process signature, which caused access checks to fail. Now, if CTE detects this scenario and has already granted access to the file, CTE prevents the access check from failing.

• AGT-45039 | AGT-45130: MOAS: fsstress test is hanging

  The rapid execution of binaries inside a GuardPoint can result in a recursive call that can freeze the application. The solution was to fix the recursion issue. Therefore, you can now run a binary from inside a GuardPoint.

• AGT-45478: Netlink process watcher is not working under CTE for Kubernetes

  The issue occurred due to an error in properly detecting process exiting. This may cause a memory leak in the agent's process tracking table. The solution was to fix the process exit detection to properly free process table entries.

• AGT-46287 CS1476716: During large batch operations where data is being processed and moved between protected folders, the data is being double encrypted

  The solution was to add protection logic to prevent nested mounting of GuardPoints which can cause double encryption.