<p>I got an email from google about that the Kubernetes project recently disclosed new security vulnerabilities.</p>

<p>was advised to upgrade the nodes as soon as the patch becomes available which is with the new version releases by March 16.</p>

<p>How soon should I do it or how long can I wait ? Because I need at least a week to plan the upgrade !!</p>

<p><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-1002101" rel="nofollow noreferrer">CVE-2017-1002101</a> affects all volume types, so to prevent the vulnerability being exploited on your cluster you'd need to deny the use of all volume types using <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">PodSecurityPolicy</a>. Refer to the <code>Mitigations prior to upgrading</code> section of the GitHub issue <a href="https://github.com/kubernetes/kubernetes/issues/60813" rel="nofollow noreferrer">here</a>.</p>

<p>There isn't an amount of time you can wait, it's just more likely to be exploited the longer you wait before upgrading. </p>
