Release Note for CTE for Kubernetes

Container Image Digest

Verify that the Container Image Digest matches the version that you are installing.

New Features and Enhancements

• Support for Trusted Pods

  CTE for Kubernetes allows only trusted pods to access protected data volumes and attach to CTE for Kubernetes claims if you activate this optional feature. CTE for Kubernetes uses signature sets to validate the pod as trusted. Signatures are in the form of key-value pairs which contain the image name and the corresponding digest value. After mapping the image signature with the received signature set, CTE for Kubernetes will allow, or prevent, mounting of the the encrypted volume.

  See Support for Trusted Pods for more information.

• Support for Using external certificates with Kubernetes

  CipherTrust Transparent Encryption can now use an external certificate, available at a user-defined path, to communicate with CipherTrust Manager.

  See Using external certificates with CTE for Kubernetes for more information.

• CTE for Kubernetes Logging

  Improved the CTE for Kubernetes logging information in the Troubleshooting section.

• CTE for Kubernetes Lifecycle and OS Support

  The CTE for Kubernetes taxonomy documentation has been updated for CTE for Kubernetes and moved to an independent location.

• Supports Rancher for Kubernetes

  CTE for Kubernetes now supports Rancher for Kubernetes.

  See Rancher for more information.

Resolved Issues

• AGT-43174: Typo in example storageclass yaml file

  CipherTrust was spelled as CipherTrust in the storageclass yaml file in the example directory. This has been fixed.

• AGT-43740 [CS1452612]: Not able to resolve CipherTrust Manager FQDN hostname when registering

  Name resolution was failing to communicate with CipherTrust Manager nodes that used FQDN, instead of an IP address so agent registration was unsuccessful. This has been fixed.

• AGT-44993: Documentation Improvement: CSI External Certificate feature

  See Using external certificates with CTE for Kubernetes for more information.

Known Issues

• AGT-41592: CTE for Kubernetes client does not display the active Data Transformation guard policy during Data Transformation

  When Offline Data Transformation is running, the Guard Policy does not display as active on CipherTrust Manager, because it does not send any Guard Policy details to CipherTrust Manager. Only after the production policy is applied to the GuardPoint do the details populate CipherTrust Manager.

• AGT-45130: CTE-CSI: fsstress test is hanging

  When multiple binaries are started from inside a GuardPoint in quick succession, a hang may occur.

  Work-around

  Do not apply policies to GuardPoints that contain binary files.

  

  Note

  Thales will release a patch to fix this issue very shortly.