Kubesploit

Falco Event Generator creates suspicious system and Kubernetes activity so teams can safely test and benchmark Falco detection rules. More: https://ku.bz/y-WmBKLPS

Supply chain security is easier to reason about when it has layers. Meg Sarros frames container trust as scanning, signing, and enforcement. She shows how teams can surface CVEs, prove image provenance, and enforce policy before workloads run. The useful mental model is defense in depth, not a single security checkbox. Watch the full interview: https://ku.bz/k_r1B0Rwj

Wardline is a self-hosted control-plane proxy for AI agents that enforces identity, policy, and budgets while using anomaly detection to block compromised agents and record auditable decisions. More: https://ku.bz/WZY4gnMtW

FQDN Network Policy turns hostnames into current IP addresses and creates standard Kubernetes NetworkPolicy rules, so teams can control outbound traffic on any CNI without replacing their network plugin. More: https://ku.bz/NprbZjd3s

"The next 10 years are going to be boring — in the good sense." Mauro Morales sees Kubernetes entering its maturity phase: more security focus, more compliance, more standardization. The excitement shifts to AI tooling that helps operators manage growing complexity — like projects using Kubernetes to deploy Kubernetes. Boring infrastructure is reliable infrastructure. Watch the full interview: https://ku.bz/8cpgjFfjn

This week on Learn Kubernetes Weekly 203: 🔥 Building Modelplane on Crossplane 🚪 Kubernetes Gateway API: Why Ingress Is Being Replaced and Which Gateway Controller to Pick 🛡️ From Fragile VMs to Bulletproof GitOps: Modernizing a DevOps Platform on AWS EKS 💾 How a 500 MB Buffer Killed Our Archival Job, and Why Streaming Fixed It 🎮 How GPU MIG + Kueue Can Transform Multi-Tenant AI Workloads on Kubernetes Read it now: https://kube.today/issues/203 ⭐️ This newsletter is brought to you by LearnKube — understand how Kubernetes works, and what to do when it breaks. Live training with 60% hands-on labs.https://ku.bz/hypSbyc-V

This tutorial shows how to let cert-manager issue Let's Encrypt certificates for services outside the cluster, using DNS-01 validation and AWS Secrets Manager as the delivery path to an OpenVPN server. More: https://ku.bz/jgr5PbzgS

This article explains how to design a production-grade MCP server for platform teams, with governance, backend clients, tool definitions and auth as four separate layers, plus the RBAC and deployment work needed before it touches a real cluster. More: https://ku.bz/6c5t89LYj

This article follows a secret from an external store into a pod through the Secrets Store CSI Driver, explaining the registrar, the SecretProviderClass and the provider plugin. It also covers syncing back into a native Kubernetes Secret for env vars. More: https://ku.bz/m70bP2hJs

Heading to KubeCon + CloudNativeCon North America? Join us the day before for our first in-person LearnKube community event. We have a full day planned: - A hands-on workshop: diagnose a deliberately broken application with telemetry, then explore how an in-cluster AI SRE agent responds. - Technical sessions and Q&A: Cost Optimization, Bank Grade Kubernetes, and AI Operations. - Lightning talks: featuring Artem Lajko, Diana Todea, and Viktor Farcic. - YAML Games - Drinks, canapes, and time to meet the community. Your hosts are Salman Iqbal, Amin Astaneh, and Bart Farrell. 📅 Monday, November 9, 2026 · 10:00–19:00 MST 📍 Hilton Salt Lake City · Salt Lake City, Utah Thank you to our event sponsors, StormForge by CloudBolt and vCluster, and our community sponsor, Utah Kubernetes Meetup. We can't wait to meet you in Salt Lake City! Register for free: https://learnkube.com/learnkube-day-salt-lake-city-2026

This tutorial builds a Docker image with a secret, then shows how it still sits in an earlier image layer after you delete it, and pulls it back out with docker history, jq and tar. More: https://ku.bz/S8r6yFdbS

This article explains how Vault piles up unexpired leases when pods keep re-authenticating with default service tokens, why that destabilises the HA cluster, and how batch tokens and shorter TTLs fix it. More: https://ku.bz/Cn61TJM1G

This article asks what a container can block on its own when a dependency turns malicious, and tests nono, a capability-based sandbox that limits file and network access at runtime. More: https://ku.bz/YdMc3KBZ6

This week on Learn Kubernetes Weekly 202: 🔥 We Replaced etcd with Google Cloud Spanner 😌 How We Made Deploying a New Service Boring 🐘 Running Zookeeper on GKE with Local SSD (Z4D) 🚀 Kubernetes v1.36: Mixed Version Proxy Graduates to Beta 🌍 Building a Multi-Region EKS Platform with Crossplane, FluxCD, and GitOps Read it now: https://kube.today/issues/202 ⭐️ This newsletter is brought to you by Buoyant — The Buoyant Enterprise for Linkerd service mesh runs in production at Xbox (22,000 pods), Imagine Learning (40% cross-zone cost cut), and IntelliGRC 4× MRR after FedRAMP https://ku.bz/BwZYjDryv

This article explains what an attacker can really do with leaked Kubernetes credentials, from kubeconfigs to service account tokens, and how to check the blast radius and shut it down. More: https://ku.bz/ppRKVtXsb

"When an agent goes loose, you might find yourself: your S3 bucket has been deleted by mistake." Tsahi Duek puts security first when it comes to AI agents. Unlike regular workloads, AI agents execute actions on your behalf — sometimes running code. That means locking them into isolated sandbox environments, scoping their access to specific services, and never giving broad permissions to your entire AWS account. Watch the full interview: https://ku.bz/2r41YKBZb

This article walks through making a container image safe before it ever reaches the cloud, using multi-stage builds, a distroless base and Trivy scans to cut the CVE count down. More: https://ku.bz/99rk_nQ-T

We just published Kubernetes Architecture in Financial Services, a free technical book about platform design and operations. Drawing on public engineering talks and case studies from seven banks, it examines: - Tenant boundaries beyond namespaces. - Shared delivery controls and application ownership. - Policy maintenance, exceptions, adoption, and reporting. - Cross-cluster identity, reliability, external dependencies, and cluster replacement. Each chapter starts with a real platform problem, compares different boundaries, and examines the operational cost of each option. Thank you to Buoyant, Sysdig, and Nirmata for supporting the book and its research. Download it for free: https://learnkube.com/kubernetes-architecture-financial-services

This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials. More: https://ku.bz/mdkryD536

Moving to Kubernetes doesn't replace your security practices, but it adds a layer on top. Rodrigo Bersa at AWS breaks down what carries over and what must change. What stays: least privilege, perimeter security, network access control, authentication and authorization. What changes: - Supply chain security — you're managing hundreds of images, not just VMs - Multi-tenancy by default — workloads share nodes; namespace isolation and network policies keep them separate - In-cluster auth needs its own model, separate from infrastructure-layer controls Watch the full interview: https://ku.bz/dB7PDNt0v