---
title: "Discussion on \"Anything can talk to anything: the Kubernetes default quietly expanding your blast radius\" | Hashnode"
description: "Discussion on \"Anything can talk to anything: the Kubernetes default quietly expanding your blast radius\". Part of the Kernel-Native Kubernetes Security series. This one is not specifically about Nyx. It is about a security assumption hiding inside many Kubernetes clusters, and a free hands-on lab you can run on your laptop in about an hour."
url: "https://hashnode.com/posts/anything-can-talk-to-anything-the-kubernetes-default-quietly-expanding-your-blast-radius/6a6a7661d589bd8a6fdb7e71"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Anything can talk to anything: the Kubernetes default quietly expanding your blast radius](https://blog.tracenyx.ai/anything-can-talk-to-anything-the-kubernetes-default-quietly-expanding-your-blast-radius?utm_source=hashnode&utm_medium=feed)

Part of the Kernel-Native Kubernetes Security series. This one is not specifically about Nyx. It is about a security assumption hiding inside many Kubernetes clusters, and a free hands-on lab you can run on your laptop in about an hour.

Jul 29 · 8 min read · blog.tracenyx.ai  
Read the article

-   [#kubernetes](https://hashnode.com/tag/kubernetes)
-   [#security](https://hashnode.com/tag/security)
-   [#devops](https://hashnode.com/tag/devops)
-   [#networking](https://hashnode.com/tag/networking)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[Tracenyx Team](https://hashnode.com/@tracenyx)

@tracenyx

  
[View profile](https://hashnode.com/@tracenyx)

Kernel-native network security for every node in your cluster — including Windows.

AI-powered Kubernetes network security. Zero trust from the kernel up.

## Responses 3

Markdown supported · ⌘↵ to post

[Amit Malhotra](https://hashnode.com/@vertro-io)

[Jul 30](https://hashnode.com/posts/anything-can-talk-to-anything-the-kubernetes-default-quietly-expanding-your-blast-radius/6a6a7661d589bd8a6fdb7e71/comment/6a6ac92e75fce62ae42fee0e)

This is one of those Kubernetes topics that's easy to underestimate. One thing I've seen repeatedly is that many teams assume namespaces provide meaningful isolation, when in reality they're often just an organizational boundary. The real blast radius is determined by the combination of NetworkPolicies, RBAC, service accounts, admission controls, and workload identity—not namespaces alone. Security by default should be about reducing the reachable surface, not just segmenting resources. A timely reminder that Kubernetes defaults are designed for flexibility, not least privilege.

[Nahid Mahmud](https://hashnode.com/@nahidmahmud555)

[Jul 30](https://hashnode.com/posts/anything-can-talk-to-anything-the-kubernetes-default-quietly-expanding-your-blast-radius/6a6a7661d589bd8a6fdb7e71/comment/6a6aafcc70759fecf79f11e5)

Bro, this is absolute gold! I was literally struggling with this exact same thing last week. Have you tried applying this same approach to larger projects as well?

[Tracenyx Team](https://hashnode.com/@tracenyx)

[Jul 30](https://hashnode.com/posts/anything-can-talk-to-anything-the-kubernetes-default-quietly-expanding-your-blast-radius/6a6a7661d589bd8a6fdb7e71/comment/6a6aafcc70759fecf79f11e5#reply-6a6ab51595fd7c13f9d0bdd4)

Thanks! Yes — Nyx runs in production on AKS and is fully tested on EKS as well. The approach scales because collection is scoped per-namespace rather than per-node: the DaemonSet sits on every node, but you choose which namespaces get monitored, so a 200-node cluster with 5 monitored namespaces costs about the same as a small one. The lab runs on kind, but it's the same enforcement path we run on real clusters.