Security & RBAC
20 articles from official documentation
Unlocking Data Security: Confidential Containers in Kubernetes
Confidential Containers are revolutionizing data protection in cloud-native environments by leveraging Trusted Execution Environments (TEEs). This technology ensures that sensitive workloads can run securely on third-party infrastructure without exposing data to operators.
- →Leverage Trusted Execution Environments (TEEs) to encrypt data during computation.
- →Integrate Kata Containers for enhanced hardware security in Kubernetes.
Making Kyverno Think It's in Production: A Practical Guide
Ever wondered how to test your Kubernetes policies without deploying them? Learn how to leverage Kyverno's CLI to simulate a production environment, ensuring your policies are battle-tested before they hit the cluster. This article dives into the mechanics of using resolveResourcesMockData for reliable policy evaluation.
- →Use resolveResourcesMockData to simulate production conditions for policy evaluation.
- →Test policies offline to catch issues before they reach your cluster.
Mastering Security Profiles Operator v1: Harden Your Kubernetes Workloads
Security is paramount in Kubernetes, and the Security Profiles Operator (SPO) simplifies managing security profiles as custom resources. With its stable API and support for seccomp, SELinux, and AppArmor, you can enhance your cluster's security posture effortlessly.
- →Utilize the Security Profiles Operator to manage security profiles as Kubernetes custom resources.
- →Leverage CRDs to define APIs for managing security profiles effectively.
Securing CI/CD for Open Source: Credentials and Verification in Kubernetes
In the world of open source, securing your CI/CD pipeline is paramount. By leveraging GITHUB_TOKENs and tools like Sigstore Cosign, you can ensure that your container images are both verified and safe. Let’s dive into how these mechanisms work together to enhance your security posture.
- →Utilize GITHUB_TOKENs with minimal read permissions to limit exposure.
- →Manage CI and production credentials in separate GitHub protected environments.
Extend Your CKA Certification: The Power of CKS
Want to keep your Kubernetes Administrator certification current? Passing the Certified Kubernetes Security Specialist (CKS) exam now extends your CKA certification. This new feature simplifies credential maintenance for cloud-native professionals.
- →Understand that passing the CKS exam extends your CKA certification.
- →Align your CKA expiration date with your new CKS certification date.
Building a Multi-Agent Security Platform on Kubernetes: Why Cloud Native is Key
Cloud-native architecture is essential for deploying agentic AI effectively. Discover how using the A2A protocol and mTLS can enhance inter-agent communication and security in your Kubernetes environment.
- →Utilize the A2A protocol for effective inter-agent coordination.
- →Secure inter-agent traffic with mTLS to enhance communication security.
Locking Down Dependencies in CI/CD: A Must for Open Source Projects
In the world of open source, securing your CI/CD pipeline is non-negotiable. Pinning GitHub Actions by SHA digest is a critical step to prevent compromised code from sneaking into your workflows. Let's dive into how to implement this effectively.
- →Pin GitHub Actions by SHA digest to prevent compromised code.
- →Use Renovate to automate SHA pinning and manage dependency updates.
Mastering IAM in Kubernetes: Beyond the Basics
Identity and Access Management (IAM) is crucial for securing Kubernetes environments. Understanding concepts like zero-trust and PEP/PDP architectures can significantly enhance your security posture. Dive in to learn how to effectively implement IAM strategies in your clusters.
- →Understand zero-trust principles to enhance security in Kubernetes.
- →Implement PEP/PDP architectures for effective authorization management.
Securing CI/CD in Open Source: Mastering Workflow Control
In the world of open source, controlling who runs what in your CI/CD pipeline is crucial for security. By leveraging a GitHub bot named Ariane, you can ensure that only trusted team members can trigger workflows, mitigating risks associated with untrusted code execution.
- →Implement Ariane to control workflow triggers based on team membership.
- →Configure `allowed-teams` to restrict workflow execution to trusted members.
Inspektor Gadget Security Audit: What You Need to Know
Inspektor Gadget is revolutionizing visibility in Kubernetes clusters, but recent security audits revealed critical vulnerabilities. One such issue involved command injection during image builds, highlighting the importance of secure coding practices.
- →Utilize eBPF to gain real-time insights into Kubernetes clusters without modifying kernel code.
- →Update to version 0.50.1 or later to address critical vulnerabilities like CVE-2026-24905.
Building a Secure Internal Developer Platform with Kubernetes and GitOps
Creating a cloud-native internal developer platform is crucial for modern development teams. By leveraging GitOps and Infrastructure as Code (IaC), you can enforce security and streamline deployments. Learn how to set up a multi-stage delivery workflow that ensures security validation before any deployment.
- →Implement Infrastructure as Code (IaC) to manage your infrastructure efficiently.
- →Use GitOps as the single source of truth for cluster management.
Reconciling Kubernetes CVEs: A Guide to Correcting Vulnerability Records
Kubernetes administrators face the challenge of managing unfixed CVEs effectively. Understanding how to reconcile these records is crucial, especially as all versions will be marked as affected by June 2026. This article dives into the mechanisms and considerations for managing these vulnerabilities in production environments.
- →Understand the role of the kube-apiserver in managing CVEs through admission webhooks.
- →Configure log verbosity with the '--v' parameter to monitor security events effectively.
Why Kubernetes Policy Enforcement Happens Too Late
Kubernetes policy enforcement often comes too late in the development cycle, causing headaches for teams. By shifting policy checks to the pull request stage, you can surface violations as inline annotations, making it easier for developers to address issues early.
- →Implement review-time enforcement to catch policy violations early.
- →Use inline annotations in pull requests for immediate feedback on Kubernetes manifests.
Automating Confidential Containers with Kyverno: A Game Changer for Kubernetes Security
Confidential Containers (CoCo) are crucial for securing workloads in untrusted environments, and automating their infrastructure is key. Kyverno acts as a powerful policy engine to ensure that your CoCo configurations are consistently applied and validated at admission time.
- →Utilize Kyverno to automate the injection of CoCo-related configurations.
- →Define `runtimeClass` to specify the required confidential runtime environment.
Kubernetes v1.36: Why You Should Ditch Service ExternalIPs
Kubernetes v1.36 marks the end of the road for .spec.externalIPs, a feature that once aimed to mimic cloud load balancers in non-cloud environments. This change is driven by security concerns, pushing you to adopt more robust alternatives like LoadBalancer Services or MetalLB.
- →Understand that .spec.externalIPs is deprecated due to security vulnerabilities.
- →Utilize LoadBalancer Services or MetalLB for exposing services in non-cloud environments.
KubeCon + CloudNativeCon Japan 2026: What You Need to Know
KubeCon + CloudNativeCon Japan 2026 is set to be a pivotal event for cloud native enthusiasts. With tracks covering everything from AI innovation to security, this conference will tackle real-world challenges in Kubernetes. Don’t miss the chance to learn from industry leaders and enhance your cloud native strategies.
- →Explore AI + ML innovations in cloud native environments.
- →Understand observability through logs, metrics, and tracing.
Kyverno 1.18: Embrace the Future of Kubernetes Policy Management
Kyverno 1.18 is here, and it’s a game changer for Kubernetes policy management. With the deprecation of ClusterPolicy resources, it's crucial to migrate to newer policy types like ValidatingPolicy and MutatingPolicy. This release also strengthens security around HTTP calls, making your clusters safer.
- →Migrate from ClusterPolicy to ValidatingPolicy, MutatingPolicy, and others to stay current.
- →Configure allow and block lists for HTTP calls to enhance security.
Kubernetes v1.36: Unremovable Admission Policies for Stronger Security
Kubernetes v1.36 introduces a game-changing feature for admission policies that can't be deleted, enhancing security. By leveraging manifest-based admission control, you can enforce policies that remain intact even under aggressive changes.
- →Define admission policies using manifest-based admission control for enhanced security.
- →Use the `staticManifestsDir` field in the AdmissionConfiguration to point to your policy directory.
Securing GitHub Actions: Best Practices for Dependency Management
In a world where CI/CD pipelines are critical, securing your GitHub Actions dependencies is non-negotiable. Pinning versions and enforcing strict permissions can prevent vulnerabilities from third-party actions. Let's dive into how to implement these strategies effectively.
- →Configure GitHub API settings to allow only 'organization-only actions' or 'explicitly named actions'.
- →Pin action versions to prevent unintentional updates that could introduce vulnerabilities.
AI Sandboxing: Kubernetes' Next Frontier
AI sandboxing is revolutionizing how we think about workload isolation in Kubernetes. By eliminating the shared Linux kernel, we can prevent exploits from cascading across workloads. This architectural shift is crucial for securing AI applications in production.
- →Eliminate the shared Linux kernel to prevent cascading exploits across workloads.
- →Implement structural isolation to contain policy failures within individual workloads.
Unified observability — logs, uptime monitoring, and on-call in one place. Used by 50,000+ engineering teams to ship faster and sleep better.
Try Better Stack free →Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.