🔒 Security
Kubernetes security recipes: RBAC, Pod Security Standards, Network Policies, secrets, image scanning, RHACS, and compliance automation.
What's New in Argo CD v3.5.4: Critical Security Patch Release
Argo CD v3.5.4 fixes multiple critical CVEs in repo-server (Kustomize, Jsonnet, OCI) plus upgrade steps and verification.
cert-manager v1.21.2: Security Patch Release Notes and Upgrade Guide
cert-manager v1.21.2 fixes ACME/Vault response-body leaks, webhook panics, and bumps Go/gRPC for security CVEs. All users should upgrade.
CVE-2026-43284 "Dirty Frag": OpenShift Privilege Escalation
Mitigate CVE-2026-43284 'Dirty Frag' kernel privilege escalation on OpenShift 4 by disabling esp4, esp6, and rxrpc kernel modules via a GitOps DaemonSet.
Kubernetes Audit Logging Configuration
Configure Kubernetes audit logging: audit policy levels and rules, kube-apiserver flags, webhook backend, OpenShift audit profiles, and jq queries.
Sandboxed Runtimes on k3s: gVisor and Kata with RuntimeClass
Deploy sandboxed container runtimes on k3s and Kubernetes with RuntimeClass: gVisor (runsc), Kata Containers, WASM, and alternatives. Isolate untrusted
Container Image Security Scanning on Kubernetes
Implement container image security scanning in Kubernetes CI/CD pipelines. Trivy, Grype, and admission controllers to prevent vulnerable images from running.
Container Image Signing and Verification on Kubernetes
Sign container images with Sigstore cosign and verify signatures at admission time with Kyverno or Connaisseur. Supply chain security for Kubernetes
ServiceAccount for Running Pods
Configure Kubernetes ServiceAccounts for Pods: token mounting, RBAC permissions, workload identity, automountServiceAccountToken control, and least-privilege
OpenShift User Account Management
Manage user accounts in OpenShift: create users, assign roles, configure identity providers, manage groups, and implement RBAC for multi-tenant clusters.
Kyverno AI Workload Provenance Verification
Use Kyverno to verify software and content provenance for AI workloads: SBOM validation, model signing with Sigstore, dataset integrity, and supply chain
Kyverno CEL Policy Model Migration
Migrate Kyverno policies from YAML-based rules to CEL expressions for type-safe, performant validation. Covers CEL syntax, migration patterns, and comparison
Kyverno Drift Prevention for GitOps
Prevent configuration drift in GitOps workflows using Kyverno: block manual kubectl edits, enforce ArgoCD/Flux ownership, and detect out-of-band changes
Kyverno ISO 27001 Compliance Policies
Implement ISO 27001 and BSI IT-Grundschutz security controls in Kubernetes using Kyverno policies: access control, cryptography, operations security, and audit
Kyverno LLM Inference Cost and Security Guardrails
Implement policy-as-code guardrails for LLM inference workloads with Kyverno: GPU quota enforcement, model size limits, cost controls, prompt injection
Kyverno ReBAC Multi-Tenant RBAC Automation
Implement Relationship-Based Access Control (ReBAC) with Kyverno to automate multi-tenant RBAC at scale: dynamic RoleBindings, namespace
Kyverno Webhook Topology and Admission Latency
Optimize Kyverno webhook topology for minimal admission latency: webhook configuration tuning, failure policies, timeout settings, and lessons from migrating
External Secrets Operator on OpenShift
Manage Kubernetes secrets from external vaults using External Secrets Operator on OpenShift. Covers ExternalSecret CRD, SecretStore configuration, and GitOps
Run:ai Keycloak SSO Authentication Setup
Configure Run:ai SSO authentication with Keycloak on OpenShift: OIDC integration, user federation, role mapping, and troubleshooting login failures.
CVE-2026-31431 Linux Kernel Crypto Fix
Security advisory for CVE-2026-31431: Linux kernel crypto algif_aead vulnerability. Impact on Kubernetes nodes and how to patch container host kernels.
Kubernetes 1.36 Constrained Impersonation
Use constrained impersonation in Kubernetes 1.36 to limit which identities a user can impersonate. Tighter RBAC control for multi-tenant clusters.
Kubernetes 1.36 External SA Token Signing
Delegate ServiceAccount token signing to external KMS or HSM systems in Kubernetes 1.36. Improve security with hardware-backed key management.
Kubernetes 1.36 Pod Certificates (mTLS)
Use Pod Certificates in Kubernetes 1.36 to authenticate Pods to the API server via mTLS. Built-in X.509 certificate provisioning without external tools.
Kubernetes 1.36 SELinux Mount-Time Labeling
Configure SELinux mount-time volume labeling in Kubernetes 1.36 to eliminate slow recursive relabeling and speed up Pod startup times dramatically.
Kubernetes 1.36 User Namespaces in Pods
Enable user namespaces in Kubernetes 1.36 for rootless containers and stronger Pod isolation. Map container root to unprivileged host UIDs.
SPIFFE/SPIRE: Workload Identity for K8s
Deploy SPIRE for Kubernetes workload identity using SPIFFE standards. Automatic mTLS certificate issuance, cross-cluster identity federation.
Kata Containers RuntimeClass Kubernetes
Deploy Kata Containers with Kubernetes RuntimeClass for hardware-isolated pods. VM-based sandboxing, microVM configuration, and multi-runtime clusters.
K8s Admission Webhooks: Validate and Mutate
Build Kubernetes validating and mutating admission webhooks. Webhook configuration, TLS setup, failure policies, and common patterns for policy enforcement.
cert-manager: Automated TLS Certificates
Automate TLS certificate management with cert-manager in Kubernetes. Let's Encrypt integration, Issuer configuration, wildcard certificates, and automatic
K8s Certificate Rotation and Management
Manage Kubernetes cluster certificates with kubeadm. Check expiration, renew certificates, configure auto-rotation, and troubleshoot TLS errors.
Harbor: Private Container Registry on K8s
Deploy Harbor container registry in Kubernetes for private image hosting. Vulnerability scanning, image replication, RBAC, Helm chart repository.
Kyverno: K8s Policy Engine Without Code
Enforce Kubernetes policies with Kyverno. Validate, mutate, and generate resources using YAML policies. Image verification, label enforcement.
K8s Pod Security Admission Standards
Configure Kubernetes Pod Security Admission with enforce, audit, and warn modes. Privileged, baseline, and restricted profiles for namespace-level pod security.
K8s RBAC: Role and RoleBinding Guide
Configure Kubernetes RBAC with Role, ClusterRole, RoleBinding, and ClusterRoleBinding. Service account permissions, least privilege, and audit examples.
K8s Secrets: Types and Usage Guide
Create and manage Kubernetes Secrets: Opaque, docker-registry, TLS, and basic-auth types. Mount as volumes, inject as env vars, and encrypt at rest.
K8s SecurityContext: Container Hardening
Configure Kubernetes SecurityContext for pods and containers. runAsNonRoot, readOnlyRootFilesystem, capabilities, seccomp profiles, and privilege escalation.
K8s ServiceAccount: Pod Identity Guide
Create Kubernetes ServiceAccounts for pod authentication. Token projection, RBAC binding, workload identity, automountServiceAccountToken, and OIDC federation.
Trivy: K8s Security Scanning and SBOM
Scan Kubernetes clusters with Trivy for vulnerabilities, misconfigurations, and secrets. Trivy Operator for continuous scanning, SBOM generation.
GKE OIDC Issuer Workload Identity
Enable OIDC issuer on GKE with --enable-oidc-issuer. Configure workload identity federation for cross-cloud auth and external IdP integration.
Kubernetes RBAC Role ClusterRole
Configure RBAC in Kubernetes with Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. Least-privilege access for users, groups, and service accounts.
EDR Flexera Agents Kubernetes Deploy
Deploy EDR and Flexera agents on Kubernetes with DaemonSets. Priority classes, host path access, exclusion paths, and security agent lifecycle.
OpenShift ACS RHACS Security Guide
Deploy Red Hat Advanced Cluster Security (RHACS/ACS) on OpenShift. Vulnerability scanning, compliance, runtime threat detection, and policy enforcement.
RHACS NFS Tenant Security Kubernetes
Enforce NFS tenant isolation with RHACS policies. Detect direct NFS mounts, wrong StorageClass usage, privileged escalation, and cross-tenant violations.
Ubuntu 26.04 LTS K8s Node Hardening
Harden Kubernetes nodes with Ubuntu 26.04 LTS Resolute Raccoon. sudo-rs Rust rewrite, APT rollback, Kernel 7.0 TDX, ROCm GPU, and secure base images.
Certificate Expiration Management K8s
Monitor and manage Kubernetes certificate expiration. kubeadm cert check, cert-manager alerts, auto-renewal, and preventing expired certificate outages.
Falco Rules for Kubernetes: Complete Guide
Write custom Falco rules for K8s runtime security. Syscall detection, container escape alerts, and cryptomining detection.
Trivy Image Scanning Kubernetes
Scan container images with Trivy on K8s. Admission webhook, CI/CD integration, CIS benchmarks, and vulnerability reporting.
Kubernetes OIDC Authentication with kubelogin
Set up OIDC SSO for the Kubernetes API server with Keycloak, Dex, or Azure/Entra ID: API server flags, kubelogin kubeconfig, and RBAC bindings for IdP groups.
RBAC Audit Review Kubernetes Guide
Audit Kubernetes RBAC permissions for security compliance. Identify over-permissioned roles, service account privileges, and least-privilege enforcement.
K8s Security Checklist 2026 Guide
Complete Kubernetes security checklist for 2026. RBAC audit, network policies, pod security standards, image scanning, and compliance hardening steps.
OpenShift OAuth Proxy Sidecar Guide
Protect K8s services with OpenShift OAuth proxy sidecar. Authentication, RBAC delegation, and SSO for internal dashboards.
OpenShift SCC Security Context Guide
Configure OpenShift Security Context Constraints for pods. Restricted, anyuid, privileged SCCs, custom SCC, and migration to PSA.
AI ML Security and Compliance Kubernetes
Secure AI and ML workloads on Kubernetes with model encryption, data governance, audit logging, network isolation for training jobs.
cert-manager Advanced Configuration
Advanced cert-manager patterns for Kubernetes. Wildcard certificates, DNS-01 challenges, certificate rotation, cross-namespace sharing.
Cilium Network Policies Kubernetes
Advanced network policies with Cilium on Kubernetes. L7 HTTP-aware policies, DNS-based egress, identity-based security, cluster-wide policies.
Cosign Image Signing Kubernetes
Verify container image signatures with Cosign and Sigstore on Kubernetes. Policy enforcement with Kyverno, supply chain security, and SBOM attestation.
Multi-Tenancy Namespaces Kubernetes
Implement multi-tenancy on Kubernetes with namespaces. Resource quotas, network policies, RBAC isolation, and hierarchical namespaces for team separation.
NetworkPolicy Recipes Cookbook K8s
Common Kubernetes NetworkPolicy recipes. Default deny, allow DNS, namespace isolation, database access, and external egress patterns for zero-trust networking.
NetworkPolicy Zero Trust Kubernetes
Implement zero-trust networking with Kubernetes NetworkPolicies. Default-deny ingress and egress, namespace isolation, DNS egress rules, and Cilium L7 policies.
OPA Gatekeeper Policy Enforcement
Enforce policies with OPA Gatekeeper on Kubernetes. ConstraintTemplates, Constraints, dry-run mode, audit, and common policies for security compliance.
RBAC Least Privilege Kubernetes
Configure Kubernetes RBAC with least-privilege Roles, ClusterRoles, and service account bindings. Audit permissions, restrict secrets access.
Sealed Secrets Management Kubernetes
Manage secrets securely with Bitnami Sealed Secrets on Kubernetes. Encrypt secrets for Git storage, cluster-scoped and namespace-scoped sealing.
Service Accounts and Workload Identity
Configure Kubernetes service accounts with cloud workload identity for AWS IRSA, GCP Workload Identity, and Azure AD pod federation.
Kubernetes Certificate Signing Requests
Use the Kubernetes CSR API to issue, approve, and manage TLS certificates. Automate certificate workflows for services, users, and kubelet rotation.
ValidatingAdmissionPolicy with CEL
Replace admission webhooks with ValidatingAdmissionPolicy and CEL expressions for in-process, low-latency Kubernetes policy enforcement.
cert-manager OVH DNS-01 Wildcard TLS
Configure cert-manager with OVH DNS-01 challenge for automated wildcard TLS certificates on k3s. Let's Encrypt production certificates with zero downtime r.
K8s Let's Encrypt Ingress with cert-manager
Automate TLS certificates for Kubernetes Ingress using cert-manager and Let's Encrypt. ClusterIssuer setup, HTTP-01 and DNS-01 challenges, and auto-renewal.
Kubernetes NetworkPolicy Default Deny Egress
Implement Kubernetes NetworkPolicy default deny egress rules. Block all outbound traffic, then allow specific destinations: DNS, external APIs.
Kubernetes Service Account Tokens: kubectl create token
Create Kubernetes service account tokens after 1.24: kubectl create token, projected volumes, custom audiences, long-lived Secret tokens, and expiry limits.
Automate Secret and Key Rotation in Kubernetes
Automate TLS certificate and secret key rotation in Kubernetes. CronJob-based rotation, external-secrets-operator, cert-manager auto-renewal.
Automate User Onboarding & Offboarding in K8s
Automate Kubernetes user onboarding and offboarding. RBAC provisioning, namespace creation, quota assignment, OIDC group sync, and access revocation scripts.
OpenShift SCC: Security Context Constraints
Configure Security Context Constraints on OpenShift. Manage SCCs for pods requiring privileged access, host networking, custom UID/GID, and volume types.
Hardware Attestation for Kubernetes Workloads
Implement remote attestation for Kubernetes workloads. Verify TEE integrity with attestation services, release secrets to verified enclaves.
Confidential Containers with Kata
Deploy confidential containers using Kata Containers and TEEs on Kubernetes. Hardware attestation, encrypted container images.
CVE-2026-3865: CSI SMB Driver Path Traversal
Fix CVE-2026-3865 Kubernetes CSI SMB driver path traversal vulnerability. Upgrade to v1.20.1, detect malicious PersistentVolumes.
AI Security Platforms on Kubernetes
Secure AI workloads on Kubernetes. Model supply chain security, prompt injection defense, LLM output filtering, AI RBAC, GPU isolation.
Confidential Computing: SGX and SEV-SNP
Deploy confidential containers on Kubernetes with Intel SGX and AMD SEV-SNP. Encrypted memory, attestation, confidential VMs, Kata Containers.
Data Sovereignty and Geopatriation
Implement data sovereignty and geopatriation on Kubernetes. Multi-region clusters, data residency policies, sovereign cloud, GDPR compliance.
Digital Provenance and Content Authenticity
Implement digital provenance on Kubernetes with C2PA content credentials. Verify AI-generated content, sign media pipelines.
Kubernetes NetworkPolicy Default Deny Examples
Kubernetes NetworkPolicy default deny examples for ingress and egress: deny all, allow DNS, ingress controller, namespace isolation and a zero-trust baseline.
Post-Quantum Cryptography on Kubernetes
Prepare Kubernetes clusters for post-quantum cryptography. NIST PQC standards, hybrid TLS certificates, quantum-safe mTLS, Istio/Cilium integration.
Preemptive Cybersecurity on Kubernetes
Implement preemptive cybersecurity on Kubernetes. Threat prediction, automated vulnerability patching, runtime behavior analysis, CNAPP.
Sovereign Air-Gapped Kubernetes Clusters
Deploy sovereign and air-gapped Kubernetes clusters. Offline installation, private registry mirrors, disconnected GitOps, sovereign cloud.
CVE-2026-4342: ingress-nginx Code Execution Fix
Patch CVE-2026-4342 in ingress-nginx — a CVSS 8.8 configuration injection vulnerability enabling arbitrary code execution. Upgrade to v1.13.9, v1.14.
K8s Audit Logging for Enterprise Compliance
Configure API server audit logging for SOC2, HIPAA, and PCI-DSS compliance. Structured audit policies, log shipping, and alerting on suspicious activity.
Enterprise Container Image Governance
Enforce image policies with admission controllers. Require signed images, block public registries, and automate vulnerability scanning gates.
Automated Secret Rotation on Kubernetes
Implement zero-downtime secret rotation with External Secrets Operator, HashiCorp Vault dynamic secrets, and rolling restarts for enterprise compliance.
Kubernetes Multi-Tenancy for Enterprise Teams
Implement secure multi-tenancy with namespace isolation, ResourceQuotas, NetworkPolicies, hierarchical namespaces, and vCluster for strong isolation.
K8s OIDC Integration with Enterprise SSO
Configure Kubernetes API server OIDC authentication with Keycloak, Azure AD, or Okta for enterprise single sign-on and group-based RBAC.
Falco Runtime Security for Kubernetes
Deploy Falco for Kubernetes runtime threat detection: modern eBPF install, default rules, custom rules, Falcosidekick alert routing and automated response.
Kubernetes Multi-Tenancy Patterns
Implement multi-tenancy in Kubernetes with namespaces, RBAC, quotas, network policies, and virtual clusters. Covers soft and hard tenancy models.
Kubernetes Security Checklist for Production
Production security checklist for Kubernetes clusters. Covers RBAC, network policies, pod security, secrets encryption, audit logging, and image scanning.
K8s RBAC: Roles, ClusterRoles, and Bindings
Configure Kubernetes RBAC with Roles, ClusterRoles, RoleBindings, and service accounts. Least privilege access control for users, groups, and applications.
Fix Kubernetes Certificate Expiry Issues
Debug and renew expired Kubernetes certificates for API server, kubelet, and etcd. Covers kubeadm cert renewal, OpenShift auto-rotation, and monitoring expiry.
Confidential Computing on Kubernetes
Deploy confidential containers with encrypted memory using Intel SGX, AMD SEV-SNP, and Kata Containers. Protect data in use from even the cluster admin.
Kubernetes Admission Controllers and Webhooks
Build validating and mutating admission webhooks for Kubernetes. Policy enforcement with OPA Gatekeeper, Kyverno, and custom webhooks.
Fix RBAC Permission Denied Errors
Debug RBAC forbidden and unauthorized errors in Kubernetes. Covers ClusterRole vs Role scope and service account permissions.
Harden Kubernetes Security Posture
Kubernetes security hardening: Pod Security Standards, RBAC least-privilege, network policies, secret encryption, and audit logging.
OpenClaw API Keys External Secrets Operator
Manage OpenClaw API keys and gateway tokens using External Secrets Operator with AWS Secrets Manager, Vault, or GCP Secret Manager on Kubernetes.
OpenClaw Pod Security Hardening on Kubernetes
Harden OpenClaw pods with read-only filesystem, dropped capabilities, non-root user, seccomp profiles, and resource limits.
Quay Default Permissions for Robot Accounts
Configure Quay Registry default permissions to auto-grant read access to robot accounts on every new repository. API and team patterns.
Add Custom CA Certificates in Kubernetes
Configure custom Certificate Authority trust in vanilla Kubernetes using ConfigMap mounts, node-level trust stores, and containerd registry configuration.
Add Custom CA Certificates in OpenShift
Configure custom Certificate Authority trust across an OpenShift cluster using proxy config, image config, and automatic CA bundle injection into pods.
GPU Tenant Bootstrap Bundle for Kubernetes
Provision GPU tenants with a single Kustomize bundle containing namespace, RBAC, NetworkPolicy, quotas, and HAProxy VIP config.
Multi-Tenant GPU Namespace Isolation
Isolate GPU workloads across tenants using namespaces, RBAC, NetworkPolicy, and ResourceQuotas on OpenShift and Kubernetes.
NetworkPolicy Deny-Default for GPU Tenants
Implement deny-by-default NetworkPolicy for GPU tenant namespaces with NCCL port exceptions and DNS egress on Kubernetes.
OpenClaw Network Policies: Default-Deny & Gradual Rollout
Default-deny NetworkPolicies for OpenClaw: restrict egress to APIs, test with audit mode, and handle edge cases before enforcement.
OpenClaw RBAC and Multi-Tenant Isolation
Configure OpenClaw RBAC policies and namespace isolation for multi-tenant Kubernetes clusters with per-team agent access controls.
Secure Secrets Management for OpenClaw
Manage API keys, bot tokens, and credentials for OpenClaw on Kubernetes using Kubernetes Secrets, External Secrets Operator, and Sealed Secrets.
OpenShift ACS Security for Kubernetes
Deploy and configure Red Hat Advanced Cluster Security (ACS/RHACS) for vulnerability scanning, compliance, network policies, and runtime threat detection.
Filter CatalogSource Operators by Package
Curate a minimal CatalogSource with only approved operators using opm index pruning and file-based catalog filtering for security and compliance.
OpenShift Cluster-Wide Pull Secret Setup
Replace admin credentials in the OpenShift cluster-wide pull secret with a Quay robot account for secure, auditable container image pulls across all namespaces.
OpenShift Custom CA for Private Registries
Configure OpenShift to trust a custom Certificate Authority for private container registries using additionalTrustedCA and image.config.openshift.io settings.
RHACS Compliance Scanning in OpenShift
Run CIS, NIST, PCI DSS, and HIPAA compliance scans with Red Hat Advanced Cluster Security and automate reporting for audits.
RHACS Custom Security Policies Guide
Create and manage custom security policies in Red Hat Advanced Cluster Security for image scanning, deployment config, and runtime enforcement.
RHACS Multi-Cluster Management
Manage security across multiple Kubernetes clusters with RHACS Central hub, secured cluster registration, and unified policy enforcement.
RHACS Network Segmentation Policies
Use Red Hat Advanced Cluster Security network graph to discover traffic flows, generate NetworkPolicies, and enforce micro-segmentation.
RHACS CI/CD Pipeline Integration
Integrate Red Hat Advanced Cluster Security into CI/CD pipelines with roxctl for image scanning, policy checks, and deployment validation.
Rotate Quay Robot Tokens in Kubernetes
Automate Quay robot account token rotation across Kubernetes namespaces with zero-downtime credential updates and validation scripts.
Update CA Certificates in Kubernetes
Rotate and update Certificate Authority (CA) certificates in Kubernetes clusters including kube-apiserver, etcd, kubelet, and custom CA bundles for TLS.
SELinux and SCC Config for GPU Operator
Understand SELinux device relabeling and Security Context Constraints (SCC) requirements for the NVIDIA GPU Operator driver pods on OpenShift.
Deploy a New Certificate Each OpenShift Tenant
Replace and activate new TLS certificates tenant by tenant in OpenShift IngressController deployments with verification steps and rollback guidance.
OpenShift Multi-Tenant TLS per IngressController
Set up tenant-isolated TLS in OpenShift by assigning a dedicated certificate Secret to each IngressController for multi-tenant routing security.
Rotate OpenShift Tenant Secrets Safely
Implement low-risk secret rotation in OpenShift multi-tenant environments using versioned Secrets and controlled rollouts.
gVisor on Kubernetes: RuntimeClass Sandbox (runsc)
Run sandboxed pods with gVisor on Kubernetes: install runsc, configure containerd, create the gvisor RuntimeClass, GKE Sandbox, enforcement, verification.
How to Integrate HashiCorp Vault with K8s
Securely manage secrets with HashiCorp Vault in Kubernetes. Learn to inject secrets into pods using the Vault Agent Injector and CSI Provider.
How to Use Workload Identity for Cloud Access
Securely access cloud services from Kubernetes pods without static credentials. Configure Workload Identity for AWS, Azure, and GCP with IRSA, Workload.
How to Configure Kubernetes API Access Control
Set up secure API server access with authentication and authorization. Configure RBAC, API groups, and audit logging for cluster security.
External Secrets Operator: Vault, AWS, Azure, GCP
Install External Secrets Operator and sync secrets from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GCP into Kubernetes Secrets, with templates.
How to Implement Advanced NetworkPolicies
Master advanced Kubernetes NetworkPolicies for fine-grained traffic control. Learn egress rules, CIDR blocks, namespace isolation, and common security.
How to Encrypt Secrets at Rest with KMS
Configure Kubernetes secrets encryption at rest using external KMS providers. Learn to set up AWS KMS, GCP KMS, and Azure Key Vault encryption.
Kubernetes Secrets Management Best Practices
Kubernetes Secrets management best practices: create and decode Secrets, encrypt etcd at rest, lock down RBAC, rotate safely, and sync from Vault or AWS.
Kubernetes Service Account: YAML, RBAC, Tokens
Create a Kubernetes ServiceAccount, attach it to a Deployment, grant least-privilege RBAC with Roles and bindings, and test it with kubectl auth can-i.
Kubernetes Pod Security Standards (PSS/PSA)
Enforce Kubernetes Pod Security Standards with Pod Security Admission: privileged, baseline and restricted levels, namespace labels, rollout and exemptions.