Kubesploit

This case study shows how Mindbody used Kyverno policy-as-code to dynamically manage Istio ingress gateways across hundreds of applications without updating individual Helm charts.

More: https://ku.bz/F6-Xr10Yv

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Tailscale
💰 $16.01M to $20.04M a year
🌎 Fully remote
→ https://ku.bz/J9Cs7QBBp

DevSecOps Engineer with Accenture Federal Services
💰 $10.84M to $20.34M a year
👨‍💻 Remote from
→ https://ku.bz/WdgxCrTlm

DevSecOps Engineer with OpenAI
💰 $364.5K to $490K a year
👨‍💻 Remote from the United States of America
→ https://ku.bz/NXd17JHfV

DevSecOps Engineer with Anthropic
💰 $300K to $405K a year
👨‍💻 Remote from
→ https://ku.bz/LzVjTfYNp

DevSecOps Engineer with Scale AI
💰 $264K to $330K a year
👨‍💻 Remote from
→ https://ku.bz/BdXCcJX58

👉 Browse 1635 jobs on Kube Careers https://kube.careers

kubectl-rexec is a kubectl plugin that provides full audit logging for kubectl exec sessions, addressing the security gap where standard exec commands leave no trace of what happens inside containers.

More: https://ku.bz/yRQZ9Jrml

"Self-service capabilities without governance is how you get outages at 3 AM."

Zain Malik from ExoStellar tackles the tension between developer empowerment and platform governance. A mature platform provides standardized interfaces that give users access to what they need—kernel layers, node layers, DOS systems—without compromising reliability.

The key insight: centralization isn't about restriction, it's about creating reliable building blocks that scale.





Watch the full interview: https://ku.bz/rwttMCncv

Nicholaos Mouzourakis, Staff Product Security Engineer at Gusto, explains how Open Policy Agent (OPA) integrates with Kubernetes for authorization. He highlights OPA's versatility and performance characteristics, noting that a single node can handle numerous requests with proper optimization.

He describes multiple deployment options, including:

- Standing up multiple OPA instances
- Setting up auto-scaling groups
- Co-locating OPA with server pods
- Running OPA as a WASM module for lower latency

Watch the full episode: https://kube.fmhttps://ku.bz/S-2vQ_j-4

This week on Learn Kubernetes Weekly 169:

🔥 When High Availability Brings Downtime
🔄 Upgrade AWS CSI Drivers in Your Multi-Tenant Kubernetes Cluster
🤖 How We Serve AI/ML Models at Scale in SAP AI Core
✅ Container Readiness Checks for Spring Boot Deployments
🌐 CoreDNS in OpenShift

Read it now: https://kube.today/issues/169

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

This tutorial teaches how to deploy HashiCorp Vault Secrets Operator on Google Kubernetes Engine to synchronize Vault secrets into Kubernetes Secret resources automatically.

More: https://ku.bz/QnvFmQp8h

Ziv Yatzik manages 600+ Postgres clusters in a closed network environment with no public cloud. After existing backup solutions proved unreliable — causing downtime when disks filled up — his team built a new architecture using pgBackRest, Argo CD, and Kubernetes CronJobs.

You will learn:

- Why storing WAL files on shared NAS storage prevents backup failures from cascading into database outages
- How GitOps with Argo CD lets them manage backups for hundreds of clusters by adding a single YAML file

Watch (or listen to) it here: https://ku.bz/Rg_sQYSmw

🌟 This episode is sponsored by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person, or remote training https://learnkube.com/training

With @Birthmarkb

Kaniop is a Kubernetes operator written in Rust for managing Kanidm identity management clusters, providing declarative identity management through GitOps workflows.

More: https://ku.bz/D1JBBy0B3

This article explains a critical security issue where AWS CSI drivers gave DaemonSet service accounts the ability to patch nodes, completely breaking node isolation in multi-tenant clusters.

More: https://ku.bz/xGP7ymMvW

Dockadvisor is a lightweight Dockerfile linter built in Go that validates your Dockerfiles with over 60 rules covering syntax, security, and best practices.

More: https://ku.bz/2DT4TqRRk

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Tailscale
💰 $16.04M to $20.08M a year
🌎 Fully remote
→ https://ku.bz/J9Cs7QBBp

DevSecOps Engineer with OpenAI
💰 $364.5K to $490K a year
👨‍💻 Remote from the United States of America
→ https://ku.bz/NXd17JHfV

DevSecOps Engineer with Scale AI
💰 $264K to $330K a year
👨‍💻 Remote from
→ https://ku.bz/BdXCcJX58

Security Architect with Dexterity
💰 $200K to $300K a year
🏠 From the office in Redwood, CA, USA
→ https://ku.bz/-Tx02LFF4

DevSecOps Engineer with Corelight
💰 $221K to $268K a year
👨‍💻 Remote from North America.
→ https://ku.bz/_D5yTqnHk

👉 Browse 1298 jobs on Kube Careers https://kube.careers

This tutorial teaches how to deploy KubeArmor runtime security on Huawei Cloud Container Engine (CCE) using BPF-LSM for dynamic kernel-level policy enforcement without static profiles or reboots.

More: https://ku.bz/vnqpX_3yc

This week on Learn Kubernetes Weekly 168:

🗑️ What Happens When You Delete a Kubernetes CustomResourceDefinition?
🌱 Making ML Training Carbon-Aware with Compute Gardener
⚡ 8 vLLM Serving Setups That Handle Spiky Traffic
🛡️ How I Prevent My Kubernetes Resources from Being Deleted When Argo Apps Are Removed
🔄 Reproducible Kubernetes Infrastructure with NixOS and OKD

Read it now: https://kube.today/issues/168

⭐️ This newsletter is brought to you by Kubex — Automated Resource Optimization for Kubernetes, GPUs and AI Workloads https://ku.bz/y98T8bWXP

traefik-oidc-auth is a Traefik plugin that secures upstream services using OpenID Connect authentication acting as a relying party for identity providers like ZITADEL, Keycloak, Microsoft EntraID, and Authentik.

More: https://ku.bz/18rD29Nlh

Most developers assume Kubernetes requires an enterprise budget. Varnit Goyal proves otherwise — he built a full three-node Kubernetes cluster for $2.16/month using Rackspace Spot Instances.

You will learn:

- How Spot Instance bidding works and which strategies keep costs and preemption low
- Using Tailscale Kubernetes operator as a free alternative to traditional load balancers
- Running real development dependencies (Kafka, Elasticsearch, Postgres) on a budget cluster

Watch (or listen to) it here: https://ku.bz/HpVyQMVv0

🌟 This episode is sponsored by LearnKube — join the 4-day Advanced Kubernetes workshop on Jan 29.(https://learnkube.com/training)

With @Birthmarkb "Vivacious voice" Farrell

Pinniped provides identity services to Kubernetes by integrating external identity providers (OIDC, LDAP, Active Directory) with clusters for secure, unified login across on-premises and cloud environments.

More: https://ku.bz/Zb8ms9RlY

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Tailscale
💰 $15.8M to $19.77M a year
🌎 Fully remote
→ https://ku.bz/J9Cs7QBBp

DevSecOps Engineer with OpenAI
💰 $364.5K to $490K a year
👨‍💻 Remote from the United States of America
→ https://ku.bz/NXd17JHfV

DevSecOps Engineer with Scale AI
💰 $264K to $330K a year
👨‍💻 Remote from
→ https://ku.bz/BdXCcJX58

Security Architect with Dexterity
💰 $200K to $300K a year
🏠 From the office in Redwood, CA, USA
→ https://ku.bz/-Tx02LFF4

DevSecOps Engineer with Corelight
💰 $221K to $268K a year
👨‍💻 Remote from North America.
→ https://ku.bz/_D5yTqnHk

👉 Browse 1282 jobs on Kube Careers https://kube.careers

This week on Learn Kubernetes Weekly 167:

⚖️ Kubernetes & KEDA: Avoiding System Failures from Imbalanced Scaling
🔐 Why DevOps should Sec: making a case for DevOps Engineers to transition to DevSecOps
🌐 Optimizing Pod IP Allocation in AWS EKS with Amazon VPC CNI Prefix Delegation
🎮 GPU Starvation in Kubernetes: How Dynamic MIG Partitioning Saved Our GPU Budget
🔄 Migrating from F5 NGINX ingress controller to the F5 NGINX gateway fabric

Read it now: https://kube.today/issues/167

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

John Howard, Senior Software Engineer at Solo.io, explains what Mutual TLS (mTLS) is and its importance in Kubernetes environments.

This two-way authentication is valuable in Kubernetes infrastructure, allowing workload-to-workload traffic to be properly authenticated. John illustrates how in a front-end to back-end scenario, the front-end service would present its own certificate to the back-end, enabling verification of identity and origin - a fundamental component for implementing zero-trust security in Kubernetes clusters.

Watch the full episode: https://kube.fmhttps://ku.bz/sk-ZF1PG9