---
title: "Sulakshana Karunarathne (@sulaa29) | Hashnode"
description: "Sulakshana Karunarathne (@sulaa29) writes on Hashnode. Read their latest articles and follow their work."
url: "https://hashnode.com/@sulaa29"
---

@sulaa29

# Sulakshana Karunarathne

@sulaa29 · Colombo · Joined October 2026

### [From Browser Click to MongoDB Query: How Traffic Actually Flows Inside a Kubernetes Cluster](https://devseccloud.hashnode.dev/from-browser-click-to-mongodb-query-how-traffic-actually-flows-inside-a-kubernetes-cluster?utm_source=hashnode&utm_medium=feed)

Node IPs, Pod IPs, ClusterIPs, DNS, kube-proxy, and why my database Service has no IP at all

15 min read · [devseccloud.hashnode.dev](https://devseccloud.hashnode.dev/from-browser-click-to-mongodb-query-how-traffic-actually-flows-inside-a-kubernetes-cluster?utm_source=hashnode&utm_medium=feed)

[Oct 25](https://hashnode.com/posts/from-browser-click-to-mongodb-query-how-traffic-actually-flows-inside-a-kubernetes-cluster/6ade1a9ac37334d611ecdb7d)

### [Running a Database as a Kubernetes Deployment? Watch Out for This Rolling-Update Trap](https://devseccloud.hashnode.dev/running-a-database-as-a-kubernetes-deployment-watch-out-for-this-rolling-update-trap?utm_source=hashnode&utm_medium=feed)

How ReadWriteOnce volumes can stall a database rollout, what StatefulSets actually fix, and what they don't.

6 min read · [devseccloud.hashnode.dev](https://devseccloud.hashnode.dev/running-a-database-as-a-kubernetes-deployment-watch-out-for-this-rolling-update-trap?utm_source=hashnode&utm_medium=feed)

[Oct 22](https://hashnode.com/posts/running-a-database-as-a-kubernetes-deployment-watch-out-for-this-rolling-update-trap/6ad9be84cbf3290f34172b55)

### [Catching over-permissive IAM in the pull request, not in production](https://devseccloud.hashnode.dev/catching-over-permissive-iam-in-the-pull-request?utm_source=hashnode&utm_medium=feed)

Why I built Cloud Policy Guard: a small Python CLI that reads a Terraform plan, scores IAM risk, and fails the pipeline before a wildcard policy ever reaches AWS.

3 min read · [devseccloud.hashnode.dev](https://devseccloud.hashnode.dev/catching-over-permissive-iam-in-the-pull-request?utm_source=hashnode&utm_medium=feed)

[Oct 15](https://hashnode.com/posts/catching-over-permissive-iam-in-the-pull-request/6ad0d4e2bd52b4e4b431f0bd)

### [Hardening a 3-tier app before Kubernetes: 6 things that were quietly broken](https://devseccloud.hashnode.dev/hardening-a-3-tier-app-before-kubernetes?utm_source=hashnode&utm_medium=feed)

Before moving Deal Aggregator to Kubernetes I audited it the way an attacker would. Public delete endpoints, a ReDoS hole, an unauthenticated database and internal tools on the open internet. Here is what I found and how I fixed each one.

5 min read · [devseccloud.hashnode.dev](https://devseccloud.hashnode.dev/hardening-a-3-tier-app-before-kubernetes?utm_source=hashnode&utm_medium=feed)

[Oct 15](https://hashnode.com/posts/hardening-a-3-tier-app-before-kubernetes/6ad0d42179583e25958b8a97)