Kubesploit

Cybersecurity is Kubernetes' biggest problem right now Marina Moore from Edera on why Kubernetes security gets harder as systems mature 📺: https://ku.bz/pzn5hfmTf

"It's really expensive in people." Molly Sheets joins Daniele and Bart on the staffing cost of seven Kubernetes provisioning models https://ku.bz/Db3VnC3nl Sponsored by LearnKube

This tutorial builds a Docker image with a secret, then shows how it still sits in an earlier image layer after you delete it, and pulls it back out with docker history, jq and tar ➤ https://ku.bz/S8r6yFdbS

This article explains how Vault piles up unexpired leases when pods keep re-authenticating with default service tokens, why that destabilises the HA cluster, and how batch tokens and shorter TTLs fix it ➤ https://ku.bz/Cn61TJM1G

This article asks what a container can block on its own when a dependency turns malicious, and tests nono, a capability-based sandbox that limits file and network access at runtime ➤ https://ku.bz/YdMc3KBZ6

This tutorial teaches how to migrate EKS from AWS VPC CNI and kube-proxy to Cilium using blue/green nodes, WireGuard encryption, and Hubble for observability ➜ https://ku.bz/sYGLb0l37

This article explains what an attacker can really do with leaked Kubernetes credentials, from kubeconfigs to service account tokens, and how to check the blast radius and shut it down ➤ https://ku.bz/ppRKVtXsb

This article explains how GKE Agent Sandbox uses gVisor to isolate untrusted AI-generated code with separate node pools, Workload Identity, RBAC, and security observability ➜ https://ku.bz/0dy9y1wPw

KubeClaw is a production-grade Helm chart for running OpenClaw AI agents on Kubernetes with secure defaults, pinned images, default-deny egress via Blocky, digest-locked upgrades, and batteries-included observability ➜ https://ku.bz/CbKpPNvJq

This article walks through making a container image safe before it ever reaches the cloud, using multi-stage builds, a distroless base and Trivy scans to cut the CVE count down ➤ https://ku.bz/99rk_nQ-T

This article explains why secrets and tokens form the access system of a platform rather than plain config, and how static secrets and short-lived tokens together decide who can reach what ➜ https://ku.bz/YTvRcJgW7

This week on the Learn Kubernetes Weekly: 🌐 DNS on AWS ⏳ Eventually Consistent ConfigMap Mounts 🚨 kubectl-mcp-tool Command Injection 🐘 PostgreSQL Lifecycle on Harvester 💰 Cassandra Bill: $30K to $10K ⭐️ Teleport Read it now: https://kube.today/issues/206

Join Graziano Casto of Akuity at LearnKube Day Salt Lake City 2026 for Kubernetes lightning talks, YAML Games, and a community reception with DJ Amin Astaneh Learn more: https://learnkube.com/learnkube-day-salt-lake-city-2026

This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step ➜ https://ku.bz/hw0Zs7JSb

Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions ➜ https://ku.bz/KqYBl17Gv

CPU and memory usage need context before you change Kubernetes requests and limits Our new open-source Resource Review Mixin brings usage, throttling, pressure, and runtime events into Grafana https://github.com/learnk8s/resource-review-mixin

This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host ➜ https://ku.bz/2pxZf_bpJ

100 pods on the same node. Node-level firewall rules don't separate them. Network policy does: east-west traffic control at the pod level. Service Mesh adds mTLS on top Rodrigo Bersa on pod security 📺: https://ku.bz/dB7PDNt0v

This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials ➤ https://ku.bz/mdkryD536

Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production ➤ https://ku.bz/SWl3-LNty

Kubesafe is a tool that prevents accidental execution of dangerous commands on the wrong Kubernetes cluster by providing a safety net for cluster management ➤ https://ku.bz/3hC23K79L

This article walks through building a Kubernetes admission webhook in Go from scratch, including the TLS trust setup and the bootstrapping deadlock nobody warns you about ➤ https://ku.bz/tdxnc5S4r

This article is a deep dive into how OpenChoreo does authorization: declarative RBAC with optional ABAC conditions, expressed as Kubernetes CRDs and evaluated by a Casbin engine ➜ https://ku.bz/D2tNKR8hY

This article walks through a real Copy Fail pod escape on Talos Linux, showing how a shared page cache breaks container isolation and why gVisor or microVMs help ➤ https://ku.bz/tYzhJx61Q

This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs ➜ https://ku.bz/cSTqKycHb

This article lays out an AI-assisted AWS DevSecOps pipeline on EKS, where Amazon Q reviews code, Inspector gates the image, DevOps Guru watches production and Step Functions decide when auto-remediation may run without a human ➜ https://ku.bz/LL-lCFNc0

This article explains why three old Kubernetes CVEs will never get a code fix, and what to change in your cluster now that scanners are about to start flagging them again ➤ https://ku.bz/22Rr95v9F

This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express ➜ https://ku.bz/7HGvXhjVr

This week on the Learn Kubernetes Weekly: 🚨 Kubernetes Health Checks Down Payments 🏗️ Hybrid Kubernetes Survey Processing ⚡ The Fastest Redis Call 🌐 CNI Deep Dive 🤔 Why CPUs Never Had This Problem ⭐️ LearnKube Read it now: https://kube.today/issues/205

This tutorial deploys that same open-source Kubernetes security console with Helm and then checks that vulnerability, posture, policy and runtime findings are really flowing, not just that the pods started ➜ https://ku.bz/tNj6RqXX_

1/10 One of the things I like about the LearnKube Telegram group is the discussion that follows the articles we share. We shared a case study about a payment service stuck in a restart loop. Its liveness probe depended on a downstream service.

This tutorial shows how to use helmsniff to render thousands of Helm charts and report risky settings, like containers running as root, as a plain CSV you can analyse ➜ https://ku.bz/_K-S8Fv5M

This article explains a new alpha feature in Kubernetes 1.36 that loads admission policies from files on disk at startup, so they are live before anything else and nobody can delete them ➤ https://ku.bz/B9JxC5dVt

This article shows how a default AWS EKS setting lets any pod reach the node's metadata service and steal its IAM credentials, then walks through the simple fix ➤ https://ku.bz/DXYZGjvf2

This article examines why Copy Fail (CVE-2026-31431) breaks container assumptions and provides a small, safe Python check to determine whether your nodes can reach the vulnerable kernel path ➤ https://ku.bz/CTv-Yf60c

This tutorial shows you how to secure Kubernetes with five Kyverno policies for resource limits, image tags, labels, restricted privileges, and signed container images through YAML examples ➜ https://ku.bz/01Vd1HLGy

This case study shows how a hidden iptables-legacy NAT rule added by Tailscale changed source IPs between Kubernetes hosts and broke etcd peer TLS, plus how the team found and removed it ➜ https://ku.bz/MNNxsw45F

Ten speakers. Five minutes each. Practical Kubernetes lessons for the community Brandt Keller from Defense Unicorns is joining the LearnKube Day lightning talks in Salt Lake City https://learnkube.com/learnkube-day-salt-lake-city-2026

This tutorial walks through wiring cert-manager and Let's Encrypt into the Istio ingress gateway on GKE, so your HTTPS certificates just renew themselves ➤ https://ku.bz/j_H7dxLV6

This article explains how to keep public EKS load balancer protected with AWS WAF, Shield Advanced, and Route 53 through automatic checks and cleanup ➜ https://ku.bz/RHYQq3W0B

NineVigil is a Kubernetes operator that runs AI agents inside gVisor sandboxes, closes their network egress with Cilium and keeps a tamper-evident audit record of every run ➤ https://ku.bz/CKghZJGt1

This tutorial teaches how to secure Kubernetes AI platforms with RBAC, NetworkPolicy, secrets, resource limits, Kyverno, OPA Gatekeeper, and automatic policy checks ➜ https://ku.bz/1DWwJ78lF

This week on the Learn Kubernetes Weekly: 🧠 Workload-Aware Scheduling ⚙️ Automaxprocs Uses One CPU 🔀 Why gRPC Routes to One Pod 🔐 Static Kubernetes OIDC Issuer 🧩 ZSvirt Open-Sourced ⭐️ NeuBird Read it now: https://kube.today/issues/204

WaaS creates browser-accessible Linux and Windows desktops as Kubernetes resources, with GitOps workflows, secure remote access, quotas, and OIDC and RBAC controls ➜ https://ku.bz/TgntmDfyC

This tutorial teaches how to preserve the real client IP behind an Istio ambient gateway with externalTrafficPolicy: Local and safely read X-Forwarded-For in Go ➜ https://ku.bz/JDVmgRYDY

🗣️ Dilshan Wijesooriya explains how upgrading to AL2023 broke their cluster autoscaler—it had been silently using the EC2 instance role instead of its own pod-level IAM role Watch the full episode: https://ku.bz/T_YPfTfDb

A Go service can be OOM-killed while its heap looks healthy Our new article explains how CPU quotas, goroutine stacks, and garbage collection affect Kubernetes requests and limits for Go https://learnkube.com/go-kubernetes-requests-limits

Software supply chain security should be part of the normal delivery workflow Przemysław Wojtunik on JFrog, Xray, signing, and verification 📺: https://ku.bz/TJRYGMWV2

This case study shows how an AKS-based GitOps platform gave on-premises clusters workload identity by publishing static OIDC discovery and JWKS files, avoiding API server changes after provisioning ➜ https://ku.bz/TpvjylBlF

This case study shows how to implement a HIPAA-compliant CI/CD pipeline using Cosign for artifact signing, OPA Gatekeeper for admission control on EKS, and long-term evidence storage in S3 ➤ https://ku.bz/TYS0yf264