I run a central ArgoCD instance in EKS and use ApplicationSets to manage several EKS clusters over private networking. One cluster is in a completely separate AWS account…
Our container images are scanned on every build, and the results often contain hundreds of high and critical findings, many of them inherited from base-image packages. In the…
I maintain the container images for our services, and vulnerability scanning produces hundreds of high and critical findings every week. Most are inherited from base-image packages, and many…
For cluster infrastructure such as External Secrets Operator and Argo CD, I may need several third-party Helm charts, each pulling multiple container images. Aside from paying for a…
Suppose an entire application stack runs on Kubernetes, with the database in one Pod and the web server in another Pod on the same node. The web server…
Suppose an entire application stack runs on Kubernetes, with the database in one Pod and the web server in another Pod scheduled on the same node. The web…
I'm planning a penetration test for a Kubernetes environment and want to define the scope realistically. Since pods and services may receive changing IP addresses, should the assessment…
I wrote about a failure mode where everything works as configured, yet an AI agent still exfiltrates data. The chain is simple: attacker-controlled text appears in a support…
Last month, one of our services started using a package I had never seen before. It had only a handful of stars, a single maintainer, and had not…
I manage multiple Kubernetes clusters for a global organization, but all of my experience has come from one company and has mostly been self-taught. I'm comfortable with our…
I work in cloud infrastructure and often see customers place their clusters behind cloud-provider security services, vulnerability scanners, and network firewalls. I recently heard someone say that most…
I'm a penetration tester who mainly works with web applications and internal networks, and I'm currently learning Kubernetes security. Tools such as kube-bench, Trivy, Falco, and admission policies…
Hi everyone! I work for a cloud provider where we offer a managed Kubernetes service. I'm tasked with finding a solution to monitor vulnerabilities within the running containers…