Kubesploit

kubeseal-convert is a tool for importing secrets from pre-existing secrets management systems (e.g. Vault, Secrets Manager) into a SealedSecret.

More: https://ku.bz/fQPD8MvbX

This article explains how to configure Kubernetes SecurityContext settings at the pod and container levels to enforce security policies like non-root execution, volume permissions, and Linux capabilities.

More: https://ku.bz/nJ8Zkh6x9

This week on Learn Kubernetes Weekly 148:

🙈 Everything was fine until Kubernetes said ‘No more CPU’
🫄 Kubernetes Capacity Planning: Getting It Wrong Is Step One (And That’s Okay!)
♻️ Kubernetes v1.33: Updates to Container Lifecycle
📕 From CI to Kubernetes Catalog: Building a Composable Platform with GitOps and vCluster
🍀 Orchestrating a Greener Cloud: Carbon-Aware Kubernetes Scheduling with Liqo and Karmada

Read it now: https://learnkube.com/issues/148

⭐️ This newsletter is brought to you by Testkube — Keep your existing API, performance, and security testing tools. Run it at scale in Kubernetes https://ku.bz/Zfrty_fcC

Shahar Azulay, Co-Founder and CEO at groundcover, explains how observability and security have become increasingly interconnected in Kubernetes environments.

He discusses how eBPF technology blurs the line between these domains, allowing groundcover to provide security insights through observability features like API mapping that identifies encryption status and PII exposure. Shahar also highlights the critical security considerations for observability data itself, explaining why groundcover uses a "bring your own cloud" approach rather than the SaaS model common among competitors.

Watch the full interview: https://ku.bz/qt-j8gMlS

This repo demonstrates CVE-2024-0132, a container escape in NVIDIA Container Toolkit.

It swaps directory contents during validation, causing the toolkit to mount the entire host filesystem into the container instead of just a library file.

More: https://ku.bz/0Z5QPQl_N

Jorrick shares how his team of eight students built a complete predictive scaling system for Kubernetes clusters using machine learning.

You will learn:

- How to implement predictive scaling using Prophet ML model, Prometheus metrics, and custom APIs to forecast Kubernetes workload patterns
- The Node Ranking Index (NRI) - a unified metric that combines CPU, RAM, and request data into a single comparable number for efficient scaling decisions
- Real-world implementation challenges, including data validation, node startup timing constraints, load testing strategies, and the importance of proper research

Watch (or listen to) it here: https://ku.bz/clbDWqPYp

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Kidnapped by an artist" Farrell

This tutorial sets up Vault's database secrets engine in AKS to generate short-lived Postgres credentials on demand, using ExternalSecrets and VaultDynamicSecret to sync them into native Kubernetes Secrets.

More: https://ku.bz/MbNs69CsB

This repository demonstrates CVE-2024-3094, the backdoor discovered in xz utils versions 5.6.0+.

It provides a Docker container with the vulnerable Debian package and a patched liblzma library to reproduce the SSH authentication bypass exploit.

More: https://ku.bz/4K_lDB_ff

This tutorial shows how to restrict access to Kubernetes services without a VPN using oauth2-proxy with ingress-nginx.

More: https://ku.bz/z67cDR8Fg

KubernetesEnumerationTool audits clusters for exploitable misconfigs, missing best practices, and RBAC overreach.

It identifies weak points like privileged pods, hostIPC, insecure tokens and tests node-level access via PowerShell modules.

More: https://ku.bz/-zW_QZVKM

This week on Learn Kubernetes Weekly 147:

🐣 Inside a Pod’s Birth: Veth Pairs, IPAM, and Routing with Kindnet CNI
✂️ How We Cut Cross-AZ Traffic Costs Between Kubernetes Services in AWS Using Istio
🙅‍♀️ allowPrivilegeEscalation: false: The Kubernetes Security Flag With a Hidden Catch
🏞️ Kubernetes v1.33: Streaming List responses
⌛️ Fine-grained control with configurable HPA tolerance

Read it now: https://learnkube.com/issues/147

⭐️ This interview is brought to you by vCluster Labs — get the free eBook "GPU-enabled Platforms on Kubernetes". Learn GPU isolation, security patterns, and production architectures for AI infrastructure https://ku.bz/ZQXLKbwL7

watchall monitors your Kubernetes cluster, snapshots all resource changes into timestamped YAML files, redacts secrets, and lets you diff resource history offline via a deltas subcommand.

More: https://ku.bz/WncbdWtvp

Frédéric, Senior SRE at BlaBlaCar, shares how his team solved the cold start problem for their 1,500 Java microservices using Istio's warm-up capabilities.

You will learn:

- Why Java applications struggle with cold starts and how JIT compilation affects initial request latency
- How Istio's warm-up feature works to gradually ramp up traffic to new pods
- Why other common solutions fail, including resource over-provisioning, init containers, and tools like GraalVM
- Real production impact from implementing this solution, including dramatic improvements in message moderation SLOs at BlaBlaCar's scale of 4,000 pods

Watch (or listen to) it here: https://ku.bz/grxcypt9j

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Javascript troll humor" Farrell

This article explains how to understand the limitations of Kubernetes' allowPrivilegeEscalation: false flag and its failure to prevent all privilege escalation methods.

More: https://ku.bz/RpcSdbpgK

Conftest lets you enforce security/compliance rules on Kubernetes, Terraform, and other configs using OPA’s Rego.

More: https://ku.bz/Cq4x8tmnM

This article explains how to deploy a sidecar container to transform mounted secrets into structured JSON or .env files for applications.

It details watching mounted secrets in real-time and regenerating output on changes.

More: https://ku.bz/xKKXSNvb7

Pangolin is a self-hosted, WireGuard-based tunnelled reverse proxy that securely exposes internal HTTP/TCP/UDP services without opening ports.

More: https://ku.bz/MzkRYlF1l

This week on Learn Kubernetes Weekly 146:

😱 When “Anti-Patterns” Become Best Practice: Lessons from Migrating a Global Pub/Sub Empire to Kubernetes
🥷 Trying to break out of the Python REPL sandbox in a Kubernetes environment: a practical journey
🕳️ Digging Deeper: How Pause containers skew your Kubernetes CPU/Memory Metrics
📕 Kubernetes Services: A Deep Dive with Examples
💰 How We Cut Our Azure Cloud Costs by 3×

Read it now: https://learnkube.com/issues/146

⭐️ This newsletter is brought to you by Tigera, the Creators of Project Calico — Learn how Calico uses eBPF for high performance, low latency, & enhanced networking https://ku.bz/d6d07C20F

This article explains how Kubernetes v1.33 fixes a security flaw by requiring authorization checks for pods using cached private container images already present on a node.

More: https://ku.bz/yPgnR0XRm

Brian, VP Cloud Platform Engineering at JPMorgan Chase, shares his ingenious side project that automatically scales Kubernetes workloads based on whether his MacBook is open or closed.

You will learn:

- How KEDA differs from traditional Kubernetes HPA
- The technical architecture connecting macOS notifications through CloudWatch
- Cost optimization strategies
- Creative approaches to autoscaling signals beyond CPU and memory

Watch (or listen to) it here: https://ku.bz/sFd8TL1cS

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "New Soundproof Studio" Farrell