20h ago · 10 min read · When organizations start using Kubernetes in production, security becomes one of the most important concerns. Multiple teams interact with the same Kubernetes cluster: Developers deploy applications
Join discussionFeb 16 · 7 min read · In Part 1, we stayed close to the kernel. We watched a process call uname(), attach a seccomp filter, and then get shut down at the syscall boundary. No permissions debate. No LSM policy. No capability check. The kernel simply said: that syscall does...
Join discussion
Feb 13 · 7 min read · Kubernetes Network Policies Guide for Pod Security Implementing zero-trust networking with Calico and Cilium As Kubernetes clusters grow in complexity and scale, the default "allow-all" networking model becomes a critical security vulnerability. In 2...
Join discussionFeb 11 · 6 min read · For any application, securely storing credentials such as passwords and API keys is critical. Kubernetes provides an inbuilt resource called Secrets, which can be injected into pods as environment variables. However, these secrets are only Base64-enc...
Join discussionNov 26, 2025 · 12 min read · Kubernetes has slim pickings when it comes to open source “posture tools.” We’ve already looked at kube-bench, which is not terrible. So, still wandering the landscape in search of the Holy Grail, we’re now turning to Fairwinds Polaris. Polaris tries...
Join discussion
Nov 11, 2025 · 14 min read · If you've managed Kubernetes clusters in production, you know the challenge. Costs that creep up unexpectedly, scaling decisions that require constant manual tuning, and a level of complexity that demands specialized expertise just to keep the lights...
Join discussion
Oct 20, 2025 · 15 min read · Last time, we walked the whole chain of Kubernetes access — from SSH on the node to the default service account that every Pod inherits. That exercise made one thing clear: Kubernetes doesn’t have a single front door. It has a series of loosely conne...
Join discussion
Sep 18, 2025 · 4 min read · Introduction As DevOps engineers, we constantly battle a security game of whack-a-mole. Every week, a new vulnerability is discovered in an OS package we don't even use, forcing us to rebuild and redeploy our container images. Let's stop making your ...
Join discussion
Aug 27, 2025 · 13 min read · By default, Kubernetes is wide open. Of course you knew that already. Any pod can talk to any other pod, in any namespace, on any port. That makes life easy for anyone putting an app into prod, and just as easy for anyone who compromises one workload...
Join discussion
Aug 20, 2025 · 5 min read · 📖 Introduction So far, we’ve been deploying everything into the default namespace. But in real-world clusters, especially in production, you’ll have multiple teams, environments, and applications sharing the same cluster. 👉 This is where Namespaces...
Join discussion