Kubesploit

Public and private registries solve different distribution problems.

Meg Sarros explains the split clearly: public registries optimize discoverability and broad access, while private registries prioritize governance, encryption, signing, and scanning for internal workloads.

The takeaway is not choosing one forever, but knowing where each model fits in your image supply chain.



Watch the full interview: https://ku.bz/k_r1B0Rwj

This case study shows how to stabilize Harbor on VMware VKS by expanding storage, upgrading the Supervisor Service, and configuring Trivy scanning to receive vulnerability results.

More: https://ku.bz/cScZ7ZQ8d

Introducing Kube Signals: the new KubeFM show that turns keynote trends into direct conversations with the speakers shaping them.

For episode one, Brian Teller sits down with Saiyam Pathak from vCluster after his KubeCon India keynote on AI factories. They examine why the GPU beneath the model is becoming a platform-engineering problem.

They discuss:

- Why whole-GPU allocation wastes capacity
- How DRA, HAMI, MIG, and MPS enable sharing
- What Kubernetes must learn to support AI factories

Watch the full episode: https://ku.bz/4QZDqrnf-

This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits.

PII-Shield is a log sanitization sidecar that redacts personal data before logs ever leave the pod, using entropy scoring and custom regex rules.

More: https://ku.bz/8nJ7hSf5b

🚀 We just published The Technical Guide to Kubernetes Rightsizing in the Age of AI.

The guide follows the complete rightsizing process, from collecting metrics to applying changes safely in production.

- It explains how requests and limits affect scheduling and Linux resource controls.
- It examines how application runtimes change CPU and memory behavior.
- It also shows how KRR and VPA turn historical data into recommendations.

The book also examines where AI can help: collecting evidence, explaining recommendations, drafting policy, and carrying approved changes across systems without breaking prod.

Thank you to Gulcan and @danielepolencic for the research, experiments, writing, and illustrations behind this book.

Download the complete guide for free:

https://learnkube.com/kubernetes-rightsizing

Nginx Rift is a proof of concept for CVE-2026-42945, a heap buffer overflow in NGINX's rewrite module that allows unauthenticated remote code execution on servers using rewrite and set directives.
The README lists affected and fixed versions.

More: https://ku.bz/PQSlZ7Khl

Kubernetes is not difficult because there are too many commands.

It is difficult because networking, scheduling, deployments, storage, autoscaling, and security interact in ways that are hard to see.

Our live Advanced Kubernetes course connects those pieces into one practical mental model.

The next online course runs on 10, 11, 17, and 18 September.

- Four days of live instruction
- 60% hands-on labs
- Small classes
- Lifetime access to the material and private Slack

Joining individually?
https://learnkube.com/online-advanced-september-2026

Need several engineers to build the same baseline? We also deliver private training around your platform, workloads, and goals:
https://learnkube.com/corporate-training

Kloak swaps placeholders for real secrets inside the kernel with eBPF, just before TLS encryption, so applications never hold credentials and need no sidecars or code changes.
Secrets can be pinned to specific hosts and ports.

More: https://ku.bz/2tGP1vSc3

IPMan is a Kubernetes operator that automates IPSec VPN setup (via StrongSwan) so your workloads can securely connect across networks.

More: https://ku.bz/Stkf6J4qr

This week on Learn Kubernetes Weekly 197:

🎛️ Kubernetes Through Control Theory Glasses: HPA
🔭 Engineering End-to-End Observability for Kubernetes Workloads
🌋 Inside Volcano Controllers: Gang Scheduling, State Machines, and Real Kubernetes Logs
🍴 We forked Apache Stateful Functions for Flink 2.x — here's why
📉 Dagster on Kubernetes: When More Nodes Won't Save You

Read it now: https://kube.today/issues/197

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

CI updates Git while Argo CD updates the cluster.

At WSC Sports, Elad Cohen separates delivery responsibilities: CI patches a values file, and Argo CD reconciles the cluster. Self-healing keeps Git as the declared state.

- Why CI and CD need separate roles
- How ApplicationSets create shadow deployments
- How AppProjects restrict team access
- Why shared Helm charts reduce one-offs

Watch: https://ku.bz/wX5H5Mjwv

This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits.

Hosted by Bart Farrell.

Hubble is a fully distributed networking and security observability platform for cloud native workloads.

It is built on top of Cilium and eBPF to enable deep visibility into the communication and behaviour of services and the networking infrastructure.

More: https://ku.bz/fmj0PvVgk

"You don't want to inhibit developers from getting things done."

Gari Singh explains how platform teams can balance self-service capabilities with governance. He discusses the importance of centralization with guardrails—policies that restrict dangerous operations while enabling developers to work effectively without being inhibited.



Watch the full interview: https://ku.bz/F_t6Y2dxz

This interview is a reaction to Ben Poland's episode https://ku.bz/klBmzMY5-

This tutorial shows how to build a simple bot-detection system from Nginx logs and use GCP controls to investigate and slow suspicious traffic.

More: https://ku.bz/GNLh0bWKs

Nicholaos Mouzourakis, Staff Product Security Engineer at Gusto, explains how Joel Spolsky's "Law of Leaky Abstractions" applies to Kubernetes environments. He emphasizes the profound concept that "abstraction saves us time working, but does not save us time learning" and introduces the idea of learning debt that must eventually be paid when abstractions leak.

Nicholaos describes how Kubernetes administrators often face complex problems with incomplete information and tight deadlines. He explains:

- Every lower-level technology you don't understand creates a learning debt
- Understanding the layers beneath your abstractions reduces troubleshooting time
- Modern containerized environments (often lacking shells for security) make this understanding even more critical
- Not understanding how layers interact creates security vulnerabilities like injection attacks

Watch the full episode: https://kube.fmhttps://ku.bz/S-2vQ_j-4

This tutorial shows how to install Microsoft's managed cert-manager extension on an AKS cluster and use it with Gateway API to issue and auto-renew Let's Encrypt certificates.

More: https://ku.bz/DFLtYT8zG

This week on Learn Kubernetes Weekly 196:

🛠️ How I Rebuilt YouTube’s Load Balancing Algorithm in Go
💾 When ETCD Crashes, Check Your Disks First: A Pod CrashLoopBack Debugging Story
🧩 We Blamed CoreDNS for Weeks. The Real Culprit Was a Default We Never Questioned
🚚 Zero-Downtime EKS Migration: Production-Grade Kubernetes at Scale
⚡ Deterministic Routing: The Hidden Key to Low Latency

Read it now: https://kube.today/issues/196

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

This article presents a three-layer tenant isolation design where each tenant gets its own control plane, VM nodes and isolated network via KubeFlex, KubeVirt and OVN-Kubernetes, with latency measurements.

More: https://ku.bz/YRcVzxByx

New from LearnKube: Setting the right requests and limits in Kubernetes.

CPU and memory requests and limits appear together in a Pod manifest, but Kubernetes and Linux use them at different stages.

You will learn:

• How the scheduler compares requests with node allocatable capacity
• Why actual usage can exceed a request
• How CPU quotas cause throttling even when average CPU looks low
• Why an OOM kill is different from a node-pressure eviction
• How requests and limits determine Kubernetes QoS classes

The article is the first chapter of The Technical Guide to Kubernetes Rightsizing, co-authored by Gulcan and Daniele Polencic.

Read the chapter:
https://learnkube.com/setting-cpu-memory-limits-requests

Download the free technical guide:
https://learnkube.com/kubernetes-rightsizing

This book was made possible by CloudBolt Software.

Karpenter can consolidate nodes and reduce cloud costs. But without Pod Disruption Budgets, those savings can expose workloads to avoidable downtime.

Ahmad Asmar from Zencity explains how they use Kyverno to generate PDBs automatically instead of relying on every developer to remember the required configuration.

You will learn:

- Why Karpenter consolidation and Spot instances make PDB coverage critical
- How Kyverno detects existing PDBs through workload labels
- Why percentage-based budgets work better for scaling workloads
- How ClusterRole aggregation extends Kyverno without modifying its Helm chart

Watch: https://ku.bz/xrlPJg54D

🌟 This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits. https://learnkube.com/kubernetes-rightsizing

With @Birthmarkb