Kubesploit

Node security and pod security are not the same problem. Rodrigo Bersa at AWS explains the difference: Nodes are a compute boundary. Block traffic with security groups or firewall rules. Pods are different. A hundred pods can run on the same node — node-level controls do nothing to separate them. That's where network policy comes in: east-west traffic control at the pod level, keeping front-end and database pods isolated even on shared hardware. For deeper control: Service Mesh with Envoy adds application-layer authorization and mTLS for pod-to-pod encryption. L4 control plus L7 auth. Watch the full interview: https://ku.bz/dB7PDNt0v

This article is a deep dive into how OpenChoreo does authorization: declarative RBAC with optional ABAC conditions, expressed as Kubernetes CRDs and evaluated by a Casbin engine. More: https://ku.bz/D2tNKR8hY

This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs. More: https://ku.bz/cSTqKycHb

This article lays out an AI-assisted AWS DevSecOps pipeline on EKS, where Amazon Q reviews code, Inspector gates the image, DevOps Guru watches production and Step Functions decide when auto-remediation may run without a human. More: https://ku.bz/LL-lCFNc0

This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express. More: https://ku.bz/7HGvXhjVr

This week on Learn Kubernetes Weekly 205: 🚨 How Kubernetes Health Checks Brought Down a Payment Service 🏗️ The cluster that runs on our own metal: rebuilding survey processing on hybrid Kubernetes ⚡ The Fastest Redis Call Is the One You Never Make 🌐 CNI Deep Dive 🤔 Why did CPUs never have this problem? Read it now: https://kube.today/issues/205 ⭐️ This newsletter is brought to you by LearnKube — understand how Kubernetes works, and what to do when it breaks. Live training with 60% hands-on labs https://ku.bz/hypSbyc-V

This tutorial deploys that same open-source Kubernetes security console with Helm and then checks that vulnerability, posture, policy and runtime findings are really flowing, not just that the pods started. More: https://ku.bz/tNj6RqXX_

This tutorial shows how to use helmsniff to render thousands of Helm charts and report risky settings, like containers running as root, as a plain CSV you can analyse. More: https://ku.bz/_K-S8Fv5M

This tutorial shows you how to secure Kubernetes with five Kyverno policies for resource limits, image tags, labels, restricted privileges, and signed container images through YAML examples. More: https://ku.bz/01Vd1HLGy

This case study shows how a hidden iptables-legacy NAT rule added by Tailscale changed source IPs between Kubernetes hosts and broke etcd peer TLS, plus how the team found and removed it. More: https://ku.bz/MNNxsw45F

LearnKube Day includes ten five-minute lightning talks from Kubernetes practitioners sharing practical lessons with the community. Brandt Keller, Staff Software Engineer at Defense Unicorns, is one of the featured lightning-talk speakers at LearnKube Day Salt Lake City 2026. The event brings together a hands-on Kubernetes workshop, technical sessions, open Q&A, lightning talks, YAML Games, and a community reception. Learn more: https://learnkube.com/learnkube-day-salt-lake-city-2026

This article explains how to keep public EKS load balancer protected with AWS WAF, Shield Advanced, and Route 53 through automatic checks and cleanup. More: https://ku.bz/RHYQq3W0B

This tutorial teaches how to secure Kubernetes AI platforms with RBAC, NetworkPolicy, secrets, resource limits, Kyverno, OPA Gatekeeper, and automatic policy checks. More: https://ku.bz/1DWwJ78lF

This week on Learn Kubernetes Weekly 204: 🧠 Workload-Aware Scheduling in Kubernetes 1.37 ⚙️ Automaxprocs Now Costs Your Go Binary a CPU 🔀 Your gRPC Service Only Talks to One Pod. Here’s Why. 🔐 Your Kubernetes OIDC Issuer Is Just Two Static Files 🧩 Why We Open-Sourced ZSvirt Read it now: https://kube.today/issues/204 ⭐️ This newsletter is brought to you by NeuBird — move beyond dashboards and runbooks with an AI agent that detects production issues, finds their root cause, and helps your team resolve them https://ku.bz/nh5ZFW_b9

WaaS creates browser-accessible Linux and Windows desktops as Kubernetes resources, with GitOps workflows, secure remote access, quotas, and OIDC and RBAC controls. More: https://ku.bz/TgntmDfyC

This tutorial teaches how to preserve the real client IP behind an Istio ambient gateway with externalTrafficPolicy: Local and safely read X-Forwarded-For in Go. More: https://ku.bz/JDVmgRYDY

Dilshan Wijesooriya, Senior Cloud Engineer at Coolblue, explains how upgrading from Amazon Linux 2 to AL2023 broke their cluster autoscaler due to stricter IMDS (Instance Metadata Service) access controls. The autoscaler had been silently relying on the EC2 instance role instead of having its own pod-level IAM role—a hidden dependency that only surfaced when the AMI changed and blocked access to instance credentials. Watch the full episode: https://ku.bz/T_YPfTfDb

Why can a Go service be OOM-killed while its heap looks healthy? The heap is only part of the container's memory usage. Goroutine stacks, native allocations, and runtime overhead also count toward the container limit. In this new article from Gulcan, you will learn: - How CPU quotas affect Go's parallelism and why extra threads can increase throttling. - How to measure total container memory, including goroutine stacks and native allocations. - Why a tighter memory budget can increase garbage collection work and reduce throughput. Read: https://learnkube.com/go-kubernetes-requests-limits This article is also included in our book on Kubernetes rightsizing: https://learnkube.com/kubernetes-rightsizing

Software supply chain security should not be treated as optional extra work. Przemysław Wojtunik explains how his team moves from build to JFrog, validation with Xray, signing, verification, and only then delivery to the customer, and why he sees that workflow as mandatory. Watch the full interview: https://ku.bz/TJRYGMWV2

This case study shows how an AKS-based GitOps platform gave on-premises clusters workload identity by publishing static OIDC discovery and JWKS files, avoiding API server changes after provisioning. More: https://ku.bz/TpvjylBlF