Patch Note for CTE for Kubernetes

Container Image Digest

Verify that the Container Image Digest matches the version that you are installing.

Resolved Issues

• This release of CTE for Kubernetes adds fixes for known defects and addresses known vulnerabilities.

• AGT-55332: Agentinfo script fails to execute if CTE for Kubernetes is deployed using Operator v1.4.13

  Executing the agentinfo command on the API playground fails on CTE-K8s nodes. The issue occurs because of missing permissions on the cte-csi-node-ca Cluster Role created by the operator. These permissions are required by the agentinfo command to get cluster-wide information. This has been fixed. Those permissions have been added.

Known Issues

• AGT-39000: CipherTrust Manager may not report all pods using the same CTE PVC on the same node

  Work-around:

  CTE PVCs with the following access modes: ReadWriteOnce, ReadWriteMany or ReadOnlyMany, may fail to report to CipherTrust Manager all of the pods using the same volume on the same node. This anomaly is due to how Kubernetes handles a single volume used across multiple pods in the same node. This reporting anomaly in CipherTrust Manager does not mean that the CTE PVC is not attached to the pod. It is recommended that the user describe the CTE PVC (# kubectl describe pvc) to find the list of all of the pods that are using a particular CTE PVC.

• AGT-41592: CTE for Kubernetes client does not display the active Data Transformation guard policy during Data Transformation

  When Data Transformation is running, the Guard Policy does not display as active on CipherTrust Manager, because it does not send any Guard Policy details to CipherTrust Manager. Only after the production policy is applied to the GuardPoint do the details populate CipherTrust Manager.

• AGT-48209: Operators do not appear to delete

  Some resources created by the operator are not being cleaned up properly. This issue can be safely ignored.

• AGT-48396: CTE-CSI | Container Attestation Issue | CM2.13, CM2.14

  The Trusted Pods feature currently only works with CipherTrust Manager v2.14 and subsequent versions.