Kubesploit

This article explores why using Kubernetes namespaces alone is not a sufficient isolation or security boundary.

It shows common pitfalls and many attack paths that let a tenant escape isolation even if you only gave them access to a single namespace.

More: https://ku.bz/PCmRjmB57

Kube No Trouble (kubent) is a tool to check whether you're using any deprecated APIs in your cluster and therefore should upgrade your workloads first, before upgrading your Kubernetes cluster.

More: https://ku.bz/zMyZdL3w6

This tutorial walks you through enabling, running, and monitoring IPv6 networking on Kubernetes clusters using Cilium

More: https://ku.bz/b6RFcGQjF

This tool provides a Model Context Protocol (MCP) server for querying Kubernetes Audit Logs across cloud providers using AWS CloudWatch, GCP Logging, and Alibaba SLS.

More: https://ku.bz/Hm_CMFF66

This week on Learn Kubernetes Weekly 160:

🌐 Kubernetes Networking from Packets to Pods
⚙️ Seamless Istio Upgrades at Scale
🔍 How I find and fix Kubernetes Exit Codes and Misconfigurations for free
🔒 Kubernetes security fundamentals: networking
📊 A Step-by-Step Guide to Jaeger Tracing on Kubernetes

Read it now: https://kube.today/issues/160

⭐️ This issue is brought to you by vCluster Labs and Learnkube. To explore the architecture from hardware to runtime and understand why GPU scheduling is different, join the free webinar on GPU Sharing Mechanisms in Kubernetes https://ku.bz/8GzcKPzzF

Ritesh Patel, Co-founder @ Nirmata, announces the recent launch of Nirmata's AI Platform Engineering Assistant.

He explains how platform engineering teams are currently overwhelmed by the need to master multiple new technologies, creating a significant productivity bottleneck. The AI assistant acts as a dedicated teammate that accelerates critical tasks in security, policy, and governance - areas that typically consume substantial time and expertise.

Watch the interview: https://ku.bz/8nkrRSG_Z

Read the announcement: https://ku.bz/8_yYZZMG4

This article explains how to enforce security and compliance by validating Kubernetes resource configs using Open Policy Agent (OPA) and Rego policies, with deployment tips for Gatekeeper and sidecars.

More: https://ku.bz/nVYydLnDP

Fabián walks through a real engineering investigation that started with a simple request: allowing cluster tenants to use third-party Kafka services. What seemed straightforward turned into a complex DNS resolution problem that required testing seven different approaches before a working solution was found.

You will learn:

- How to implement the final solution using node-local DNS and CoreDNS templating with practical details including ndots configuration and Kyverno automation
- Platform engineering evaluation criteria for assessing solutions based on maintainability, self-service capability, and evolvability in multi-tenant environments

Watch (or listen to) it here: https://ku.bz/NsBZ-FwcJ

🌟 This episode is sponsored by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person or remote training.https://learnkube.com/training

With @Birthmarkb "Performance reviewer" Farrell

This tool lets your Kubernetes cluster automatically issue TLS certificates for pods by handling PodCertificateRequest resources with a custom signer controller.

More: https://ku.bz/9l1Dq8skJ

Harsha Koushik, a Security Researcher and Technical Product Manager at Palo Alto Networks, explores the evolving landscape of cybersecurity attack surfaces.

He explains the shift from traditional perimeter-focused defenses to more sophisticated attackers' methods, such as targeting supply chains and transient dependencies.

Harsha emphasizes the critical need to sign artifacts, including image layers and libraries, to safeguard against these advanced threats.

Watch the full episode: https://ku.bz/n_sJ04xMY

Alex Arnell, Principal Member of Technical Staff at Heroku, shares three Kubernetes tools he's actively monitoring from both production experience and personal interest.

He provides insights into the OpenTelemetry Operator, which Heroku uses extensively for managing collectors and auto-instrumentation, particularly highlighting the target allocator feature for dynamic collector configuration.

Alex also discusses SPIFFE and Spire for identity management, noting the quality of their Kubernetes implementation and certificate provisioning capabilities for workload identity verification. Finally, he covers KEDA (Kubernetes Event-Driven Autoscaler), explaining its appeal for platform-as-a-service providers due to its scale-to-zero capabilities and telemetry integrations, even though Heroku isn't currently using it in production.

Watch the full interview: https://ku.bz/Lsr8gltrH

Gordon Myers explains why thorough testing is critical when implementing webhooks in Kubernetes.

He shares a real-world example of building a Mutating Webhook that injects secrets from HashiCorp Vault into running applications using pod annotations. The discussion covers:

- How a 500 error in webhooks can prevent pods from launching entirely
- The implementation of a custom entry point script for injecting secrets as environment variables
- Why webhooks require extensive unit testing due to their cluster-wide impact

The example demonstrates how seemingly simple webhook implementations can have significant consequences for the entire Kubernetes cluster if not properly tested.

Watch the full episode: https://ku.bz/Dmn93dd7M

This week on Learn Kubernetes Weekly 159:

🔥 Kubernetes CPU Limits: Scylla and Charybdis
🧭 Kubernetes v1.34: Finer-Grained Control Over Container Restarts
🗂️ Understanding Kubernetes Cached Clients: How They Work and Why They Matter
💸 Understanding the True Cost of a Kubernetes Workload
🪙 Cloud Cost Optimization: A Senior Engineer’s Guide

Read it now: https://kube.today/issues/159

⭐️ This newsletter is brought to you by Heroku. Discover the thriving ecosystem of contributors, companies, and career paths in the Kubernetes World book https://ku.bz/bhlMdNf61

Amos walks through his production incident where adding a home computer as a Kubernetes node caused TLS certificate renewals to fail.

You will learn:

- How Kubernetes networking assumptions break when mixing cloud VMs with nodes behind consumer routers, and why cert-manager challenges fail in NAT environments
- The differences between CNI plugins like Flannel and Calico, particularly how they handle IPv6 translation
- Debugging techniques for network issues using tools like netshoot, K9s, and iproute2
- Best practices for mixed infrastructure including proper node labeling, taints, and scheduling controls

Watch (or listen to) it here: https://ku.bz/6Ll_7slr9

🌟 This episode is sponsored by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person or remote training https://learnkube.com/training

With @Birthmarkb "50 off grid YT shorts" Farrell

Ratan Tipirneni, President & CEO @ Tigera, announces Calico AI, a new AI-powered initiative designed to unlock the value of Tigera's existing Calico platform.

He explains how Calico serves as a unified platform for Kubernetes networking, network security, and observability, and describes their strategy to leverage AI as an umbrella term for innovation over the next couple of years

Watch the interview: https://ku.bz/fwFG0jZNk

Read the announcement: https://ku.bz/1nljhB1vQ

This tutorial walks you through deploying SPIFFE and SPIRE in Kubernetes to issue cryptographically secure, auto-rotating identities to workloads, enabling mTLS and zero-trust communication.

More: https://ku.bz/HsWb7TCYL

Alex Chircop, Chief Architect @ Akamai, discusses three emerging Kubernetes tools he's tracking that address sophisticated workload challenges.

He explores KCP for scaling Kubernetes as a control plane to handle massive orchestration numbers, the ongoing challenges with OpenTelemetry for observability and, finally, and advanced access control systems beyond traditional CEL and OPA.

Watch the full interview: https://ku.bz/jHLJL8H6t

OpenBao provides an open-source solution to manage, store, and distribute secrets, certificates, and keys with secure encryption, dynamic secrets, automated leasing, and detailed revocation.

More: https://ku.bz/qg3j1t67t

This week on Learn Kubernetes Weekly 158:

🔥 From Linux Primitives to Kubernetes Security Contexts
🚀 Migrating OpenShift Stateful Workloads to Azure Kubernetes Service (AKS)
🧠 Tuning Linux Swap for Kubernetes: A Deep Dive
💻 Remote Development Environment Supercharged with MCP Servers
🔍 Tracing Strategies for LLMs Running on Google Cloud Run

Read it now: https://kube.today/issues/158

⭐️ This issue is brought to you by StormForge by CloudBolt and LearnKube. Join "Kubernetes Scheduling Deep Dive: Priority, Preemption, and Resource Requests" and learn how to protect critical workloads under resource pressure https://ku.bz/jTvQKH2sn

This open-source platform lets you run a self-hosted zero-trust secure access solution supporting VPN-like WireGuard/QUIC, ZTNA, API/AI gateways, homelab access and Kubernetes ingress on your own infrastructure.

More: https://ku.bz/JWMdMH_J8