Discussion on "Anything can talk to anything: the Kubernetes default quietly expanding your blast radius"

Tracenyx Team · 2026-07-29T21:53:37.550Z

Part of the Kernel-Native Kubernetes Security series. This one is not specifically about Nyx. It is about a security assumption hiding inside many Kubernetes clusters, and a free hands-on lab you can run on your laptop in about an hour.

Amit Malhotra

Jul 30

This is one of those Kubernetes topics that's easy to underestimate. One thing I've seen repeatedly is that many teams assume namespaces provide meaningful isolation, when in reality they're often just an organizational boundary. The real blast radius is determined by the combination of NetworkPolicies, RBAC, service accounts, admission controls, and workload identity—not namespaces alone. Security by default should be about reducing the reachable surface, not just segmenting resources. A timely reminder that Kubernetes defaults are designed for flexibility, not least privilege.

Nahid Mahmud

Jul 30

Bro, this is absolute gold! I was literally struggling with this exact same thing last week. Have you tried applying this same approach to larger projects as well?

Thanks! Yes — Nyx runs in production on AKS and is fully tested on EKS as well. The approach scales because collection is scoped per-namespace rather than per-node: the DaemonSet sits on every node, but you choose which namespaces get monitored, so a 200-node cluster with 5 monitored namespaces costs about the same as a small one. The lab runs on kind, but it's the same enforcement path we run on real clusters.

Anything can talk to anything: the Kubernetes default quietly expanding your blast radius

Written by

Responses3

Search Hashnode

Anything can talk to anything: the Kubernetes default quietly expanding your blast radius

Written by

Responses3