Cloudflare’s commitment to CISA Secure-By-Design pledge: delivering new kernels, faster

This post details Cloudflare's commitment to the CISA Secure-by-Design pledge by focusing on the secure and timely patching of the Linux kernel. It outlines the rigorous process for kernel updates, from upstream release to production deployment, including internal testing, phased rollouts, and the use of employee traffic for validation. The post also highlights the development of automated systems like 'unimog' for traffic management during reboots and 'Reboau' for control plane kernel maintenance, ensuring consistent security across the entire infrastructure.