Security & RBAC
20 articles from official documentation
Runtime Security for AI Workloads: Extending Kubernetes Policy Enforcement
As AI workloads proliferate, securing them in Kubernetes becomes critical. Nirmata Runtime leverages eBPF for kernel-level policy enforcement, extending beyond traditional admission controls. This article dives into how you can implement runtime policies effectively.
- →Utilize Nirmata Runtime for kernel-level security enforcement in Kubernetes.
- →Define `RuntimePolicy` to control behaviors like exec, open, and network egress.
Navigating NIS2 and DORA Ownership in Kubernetes Teams
Understanding who owns NIS2 and DORA regulations on your Kubernetes platform team is crucial for compliance and security. The traceability chain involves specific roles across risk, legal, and security teams, alongside your platform and application teams. Get ready to clarify responsibilities and streamline your compliance efforts.
- →Define ownership for NIS2 and DORA within your Kubernetes platform team.
- →Implement the RACI model to clarify roles and responsibilities.
Guardrails, Not Gates: Rethinking Policy in Kubernetes
In a world where developer experience clashes with security, adopting a guardrail approach can transform your platform team's policies. Instead of blocking progress, guardrails guide developers while ensuring compliance. Learn how to implement validation effectively with Kyverno's enforcement settings.
- →Adopt guardrails to enhance developer experience while ensuring compliance.
- →Configure `validationFailureAction` in Kyverno to manage policy enforcement effectively.
Security Slam 2026: Elevate Your Kubernetes Security Posture
Get ready for Security Slam 2026, a 30-day virtual event designed to boost your project's security hygiene. Leverage OpenSSF projects and engage with advisors in a dedicated CNCF Slack channel to tackle security challenges tailored to your maturity level.
- →Participate in Security Slam 2026 to systematically improve your project's security posture.
- →Utilize OpenSSF projects to achieve tailored security hygiene milestones.
Per-Pod Image Pull Permissions in EKS: Mastering ECR Policies
Tired of managing image pull permissions at the node level? Discover how to implement per-pod image pull permissions using ECR repository policies on Amazon EKS. This approach leverages IAM roles for service accounts to enhance security and control.
- →Create a pull IAM role per team to manage image access effectively.
- →Use the eks.amazonaws.com/ecr-role-arn annotation for pod-level permissions.
Kubernetes Access via Public Clients: Mastering OIDC with PKCE
Unlock secure Kubernetes access by leveraging public clients and PKCE. This approach mitigates the risk of intercepted authorization codes, ensuring robust authentication. Dive in to learn how to configure your identity provider effectively.
- →Configure kubectl with the kubelogin exec plugin to streamline authentication.
- →Use PKCE to enhance security by preventing interception of authorization codes.
Mastering Vulnerability Reports in Open Source: A Kubernetes Perspective
Handling vulnerability reports is crucial for maintaining the integrity of your open source projects. Establish a clear reporting path in your SECURITY.md file to streamline the process. This article dives into the mechanics of vulnerability management and the importance of embargo periods.
- →Define a clear reporting path in SECURITY.md to guide users on how to report vulnerabilities.
- →Implement an embargo period to manage vulnerability discussions privately before public disclosure.
KubeletInUserNamespace: Elevating Security in Kubernetes v1.37
Kubernetes v1.37 takes a significant step in security by promoting the KubeletInUserNamespace feature gate to beta. This feature allows node components to run as non-root users, reducing the risk of potential damage. Discover how this works and what you need to know for production.
- →Enable KubeletInUserNamespace to run node components as non-root users.
- →Utilize Linux kernel user namespaces to limit privileges effectively.
Kubernetes v1.37: Mastering Pod Certificates and Cluster Trust Bundles
Kubernetes v1.37 introduces Pod Certificates and Cluster Trust Bundles, revolutionizing how you manage identity and trust in your clusters. With built-in X.509 certificate issuance, you can streamline TLS and mTLS for your workloads. Dive into the mechanics and production realities of this powerful feature.
- →Utilize Pod Certificates for secure TLS and mTLS communication between workloads.
- →Configure your application to request certificates in the pod spec for seamless integration.
Break-Glass Access for EKS: Your Emergency Lifeline
When federated identity systems fail, you need a reliable backup. Break-glass access for Amazon EKS provides an emergency path that requires no external identity system, ensuring you can regain control when it matters most.
- →Establish a dedicated role in a separate operations account for emergency access.
- →Use AWS STS to issue temporary credentials with a complete audit trail.
Navigating Data Sovereignty in Cloud Native Kubernetes Deployments
Data sovereignty is a critical concern for organizations operating in a global landscape. With the US CLOUD Act compelling data access, understanding data residency and sovereignty is essential for Kubernetes deployments.
- →Understand data residency as the physical location of your data.
- →Recognize the implications of the US CLOUD Act on data stored in Europe.
Mastering EKS Certificate Authority Rotation: Keep Your Cluster Secure
Certificate authority (CA) rotation is crucial for maintaining the security of your Amazon EKS cluster. This process ensures that your cluster transitions smoothly to a new CA while maintaining connectivity. Learn how to manage this lifecycle effectively to avoid disruptions.
- →Understand CA rotation to maintain cluster security and avoid downtime.
- →Utilize the dual trust period to ensure seamless transitions between CAs.
Securing ECS Workloads: Mastering VPC Encryption and Service Connect TLS
In a world where data breaches are rampant, encrypting traffic between your Amazon ECS workloads is non-negotiable. Leverage VPC encryption controls and Service Connect TLS to enforce application-layer encryption and maintain a robust security posture.
- →Utilize VPC encryption controls for centralized visibility and enforcement of encryption in transit.
- →Activate Enforce mode to automatically secure traffic during task replacements.
Kyverno: A Platform Primitive for Kubernetes, Not Just a Security Tool
Kyverno is more than a security tool; it's a foundational building block for Kubernetes. It enables you to validate, mutate, generate, and verify images, allowing for more dynamic and flexible resource management. Discover how to leverage its capabilities effectively in your production environment.
- →Understand Kyverno as a platform primitive that enables dynamic resource management.
- →Leverage validation to enforce compliance before configurations are applied.
Meet Falkey and Ky: Your Kubernetes Guardians
In the ever-evolving cloud native landscape, security and compliance are paramount. Enter Falkey the Falco and Ky the Kyverno Pyrenees, your vigilant allies in safeguarding Kubernetes clusters. Discover how these two guardians can help you maintain a secure and compliant environment.
- →Utilize Falkey to monitor for potential threats in your Kubernetes environment.
- →Implement Ky to enforce compliance and ensure workloads remain drift-free.
Shadow AI in CI/CD: Securing the Path from Developer Laptop to Kubernetes
Shadow AI tools are creeping into your CI/CD pipelines without oversight, posing significant risks. Understanding how these tools operate and the potential for prompt injection is crucial for safeguarding your deployments. Dive into how to model these threats effectively.
- →Implement a human ownership model for every AI agent to ensure accountability.
- →Constrain AI tools with least privilege to minimize potential risks.
Cortex Security Audit: What You Need to Know
Cortex has completed a rigorous security audit by OSTIF, enhancing its credibility as a multi-tenant storage solution for Prometheus and OpenTelemetry. The audit focused on the security health of tenant boundaries and cluster operations, using advanced code review techniques. This is crucial for anyone looking to deploy Cortex in sensitive environments.
- →Understand the importance of tenant boundary security in Cortex.
- →Review the findings of the Quarkslab audit for insights on security posture.
Runtime Supply Chain Verification with NRI: Securing Your Kubernetes Deployments
In a world where supply chain attacks are rampant, ensuring the integrity of your container images is crucial. The Node Resource Interface (NRI) allows you to enforce supply chain verification at runtime, leveraging plugins to validate image attestations before they even start. Dive into how this mechanism works and what you need to watch out for in production.
- →Implement the Supply Chain NRI Plugin to enforce image verification at runtime.
- →Configure `fetch_timeout` to manage how long the plugin waits for attestations.
Unlocking Data Security: Confidential Containers in Kubernetes
Confidential Containers are revolutionizing data protection in cloud-native environments by leveraging Trusted Execution Environments (TEEs). This technology ensures that sensitive workloads can run securely on third-party infrastructure without exposing data to operators.
- →Leverage Trusted Execution Environments (TEEs) to encrypt data during computation.
- →Integrate Kata Containers for enhanced hardware security in Kubernetes.
Making Kyverno Think It's in Production: A Practical Guide
Ever wondered how to test your Kubernetes policies without deploying them? Learn how to leverage Kyverno's CLI to simulate a production environment, ensuring your policies are battle-tested before they hit the cluster. This article dives into the mechanics of using resolveResourcesMockData for reliable policy evaluation.
- →Use resolveResourcesMockData to simulate production conditions for policy evaluation.
- →Test policies offline to catch issues before they reach your cluster.
35% off the CKA and other certifications with code OCT26NONCYBER, or 40% off Kubernetes security certs (CKS, KCSA) with OCT26CYBER.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.