News and links on Kubernetes security curated by the @Learnk8s team Mastodon: @kubesploit@learnk8s.news
More K8s news, events, jobs →
Joined March 2021
- Tweets3.1K
- Following1
- Followers21.3K
- Likes795
This article walks through making a container image safe before it ever reaches the cloud, using multi-stage builds, a distroless base and Trivy scans to cut the CVE count down
➤ ku.bz/99rk_nQ-T
This article explains why secrets and tokens form the access system of a platform rather than plain config, and how static secrets and short-lived tokens together decide who can reach what
➜ ku.bz/YTvRcJgW7
Kubesploit retweeted
This week on the Learn Kubernetes Weekly:
🌐 DNS on AWS
⏳ Eventually Consistent ConfigMap Mounts
🚨 kubectl-mcp-tool Command Injection
🐘 PostgreSQL Lifecycle on Harvester
💰 Cassandra Bill: $30K to $10K
⭐️ Teleport
Read it now: kube.today/issues/206
Kubesploit retweeted
Join Graziano Casto of Akuity at LearnKube Day Salt Lake City 2026 for Kubernetes lightning talks, YAML Games, and a community reception with DJ Amin Astaneh
Learn more: learnkube.com/learnkube-day-…
This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step
➜ ku.bz/hw0Zs7JSb
Kubesploit retweeted
Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions
➜ ku.bz/KqYBl17Gv
Kubesploit retweeted
CPU and memory usage need context before you change Kubernetes requests and limits
Our new open-source Resource Review Mixin brings usage, throttling, pressure, and runtime events into Grafana
github.com/learnk8s/resource…
This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host
➜ ku.bz/2pxZf_bpJ
Kubesploit retweeted
100 pods on the same node. Node-level firewall rules don't separate them. Network policy does: east-west traffic control at the pod level. Service Mesh adds mTLS on top
Rodrigo Bersa on pod security
📺: ku.bz/dB7PDNt0v
This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials
➤ ku.bz/mdkryD536
Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production
➤ ku.bz/SWl3-LNty
Kubesploit retweeted
Kubesafe is a tool that prevents accidental execution of dangerous commands on the wrong Kubernetes cluster by providing a safety net for cluster management
➤ ku.bz/3hC23K79L
This article walks through building a Kubernetes admission webhook in Go from scratch, including the TLS trust setup and the bootstrapping deadlock nobody warns you about
➤ ku.bz/tdxnc5S4r
This article is a deep dive into how OpenChoreo does authorization: declarative RBAC with optional ABAC conditions, expressed as Kubernetes CRDs and evaluated by a Casbin engine
➜ ku.bz/D2tNKR8hY
This article walks through a real Copy Fail pod escape on Talos Linux, showing how a shared page cache breaks container isolation and why gVisor or microVMs help
➤ ku.bz/tYzhJx61Q
This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs
➜ ku.bz/cSTqKycHb
Kubesploit retweeted
This article lays out an AI-assisted AWS DevSecOps pipeline on EKS, where Amazon Q reviews code, Inspector gates the image, DevOps Guru watches production and Step Functions decide when auto-remediation may run without a human
➜ ku.bz/LL-lCFNc0
This article explains why three old Kubernetes CVEs will never get a code fix, and what to change in your cluster now that scanners are about to start flagging them again
➤ ku.bz/22Rr95v9F
This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express
➜ ku.bz/7HGvXhjVr
Kubesploit retweeted
This week on the Learn Kubernetes Weekly:
🚨 Kubernetes Health Checks Down Payments
🏗️ Hybrid Kubernetes Survey Processing
⚡ The Fastest Redis Call
🌐 CNI Deep Dive
🤔 Why CPUs Never Had This Problem
⭐️ LearnKube
Read it now: kube.today/issues/205
