Learn how to use a Kubernetes admission controller to authorize external requests by creating a custom authorization service, generating TLS certificates, and configuring deployment and service manifests.

More: https://itnext.io/kubernetes-webhook-admission-controller-3271d041c636

This episode explores Admission Controllers and Webhooks with Gordon Myers, who shares his experience implementing webhook solutions in production.

You will learn:

- How the Kubernetes API processes requests through authentication, authorization, and Admission Controllers.
- Best practices for testing webhooks and avoiding common pitfalls that can break cluster deployments.
- Real-world examples of webhook implementations, including injecting secrets from HashiCorp Vault into containers.

Watch (or listen to) it here: https://kube.fm/webhooks-aop-gordon

🌟 This episode is sponsored by @Learnk8s: get started on your Kubernetes journey through comprehensive online, in-person or remote training https://learnk8s.io/training

With @Birthmarkb "Joyful and empowering voice" Farrell

This article provides an in-depth exploration of Kubernetes networking, tracing the journey of a network packet through a cluster and highlighting the crucial role of Network Policies in securing applications.

More: https://otterize.com/blog/mastering-kubernetes-networking-otterize-s-journey-in-cloud-native-packet-management

This week on Learn Kubernetes Weekly 104:

🤔 Why sometimes the PID 1 process cannot be killed in a container
📕 Understanding DNS in Kubernetes
🏥 From fragile to faultless: Kubernetes self-healing in practice
🚧 The trouble with topology-aware routing: sacrificing reliability in the name of cost savings
♻️ Taming FluxCD Helm releases: the Kustomize way approach

Read it now: https://learnk8s.io/issues/104

⭐️ Become an expert in Kubernetes. Join the next instructor-led Learnk8s training and learn how to master Kubernetes scaling, security and development https://learnk8s.io/training

This article provides a guide to Falco, a system threat detection engine.

It covers its installation, rule creation, architecture, and use with containers and Kubernetes.

More: https://a-cup-of.coffee/blog/falco

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Worldcoin
💰 $236K to $323K a year
🏠 From the office in San Francisco, CA, USA
→ https://kube.careers/t/e824f971-4831-4329-8dfd-2edcce0c9ed5?s=55

DevSecOps Engineer with Gemini
💰 $248K to $310K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/03598248-6bcb-4117-85b1-ecba6edb3070?s=55

DevSecOps Engineer with Uniswap Labs
💰 $264K to $294K a year
🏠 From the office in New York, NY, USA
→ https://kube.careers/t/3d7c0bd7-abd8-4526-a376-458f65018709?s=55

Security Architect with Adobe Inc.
💰 $191.7K to $345.7K a year
🏠 From the office in Seattle, WA / San Francisco / San Jose, CA, USA
→ https://kube.careers/t/b6de3faf-adb8-462a-9dd9-260446149b27?s=55

👉 Browse all 1231 Kubernetes jobs on Kube Careers https://kube.careers

Hillai Ben-Sasson and Ronen Shustin, Security Researchers at Wiz, emphasized that containers should not be solely relied upon as security barriers due to their vulnerability to kernel exploits and common misconfiguration.

They also pointed out significant risks associated with strong secrets within Kubernetes environments, which can grant extensive read and write access across different cloud services and customers.

Watch the full episode: https://kube.fm/hacking-alibaba-ronen-hillai

The article examines the kube-proxy API, covering its healthz and metrics components, and the information it provides without authentication.

More: https://raesene.github.io/blog/2024/06/16/Taking-A-Look-At-The-Kube-Proxy-API

Kubernetes in action: from pods to production-ready clusters!

📆 Learnk8s runs a 4-day online Advanced Kubernetes course next week!

You will learn how to:

1️⃣ Architect and design resilient clusters (in the cloud or on-prem).
2️⃣ Master deployment strategies and resource management.
3️⃣ Wire the cluster network and trace packets flowing through it.
4️⃣ Secure your cluster with the latest best practices.
5️⃣ Autoscale, manage data and stateful workloads, monitoring and more.

What you need to know:

✅ 40% lecture, 60% hands-on labs.
✅ Small groups for personalized learning.
✅ Progresses from basics to advanced topics.
✅ Lifetime access to course materials and Slack community.

Ticket and info: https://kube.events/t/3ae8e890-0f78-40e8-854e-849964bb8aee

Corporate training: https://learnk8s.io/corporate-training

kubeztl is a tool that zitifies the Kubernetes client, allowing users to access their Kubernetes cluster securely using a zero-trust overlay network.

More: https://github.com/openziti-test-kitchen/kubeztl

The article walks through a hands-on lab where a Flask application is exploited to gain initial access to a Kubernetes cluster.

This is followed by privilege escalation using GitHub CI/CD credentials and exfiltrating sensitive data from a database.

More: https://soc-inspiration.medium.com/hands-on-lab-full-kubernetes-compromise-what-will-your-soc-do-about-it-3866106cf041

Paul Butler, founder of Jamsocket, discusses how to identify necessary vs unnecessary complexity in Kubernetes and explains how his team successfully runs production workloads by being selective about which features they use.

You will learn:

- Why to be cautious with features like CRDs, StatefulSets, and Helm and how to evaluate if you really need them.
- How to stay on the "happy path" in Kubernetes by focusing on stable and simple resources like Deployments, Services, and ConfigMaps.
- When to consider alternatives like Google Cloud Run for simpler deployments that don't need the full complexity of Kubernetes.

Watch (or listen to) it here: https://kube.fm/kubernetes-hater-s-guide-paul

🌟 This episode is sponsored by Syntasso, the creators of Kratix, a framework for building composable internal developer platforms https://ku.bz/CJNDlLXVS

With @Birthmarkb "Diet Coke Lover" Farrell

helmper is a Go program that reads Helm Charts from remote OCI registries and pushes the charts container images to your registries with optional OS-level vulnerability patching.

More: https://github.com/ChristofferNissen/helmper

This week on Learn Kubernetes Weekly 105:

🇨🇳 Chinese Docker Hub complete shutdown: how far can Kubernetes image repositories go?
🤯 Overengineering this blog's preview site with Kubernetes
🧐 Taking a look at the Kube-proxy API
🥇 Kubernetes: the road to 1.0
🏃‍♂️ Extending Kubernetes functionality: A practical guide to custom resource definitions

Read it now: https://learnk8s.io/issues/105

🌟 This newsletter is brought to you by Syntasso, creators of Kratix, a framework for building composable developer platforms. Deploy on Kubernetes with speed, safety, and scalability https://ku.bz/0F0XMbqgN

Pinniped is the easy, secure way to log in to your Kubernetes clusters.

More: https://github.com/vmware-tanzu/pinniped

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Worldcoin
💰 $236K to $323K a year
🏠 From the office in San Francisco, CA, USA
→ https://kube.careers/t/e824f971-4831-4329-8dfd-2edcce0c9ed5?s=55

DevSecOps Engineer with Gemini
💰 $248K to $310K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/03598248-6bcb-4117-85b1-ecba6edb3070?s=55

DevSecOps Engineer with Uniswap Labs
💰 $264K to $294K a year
🏠 From the office in New York, NY, USA
→ https://kube.careers/t/3d7c0bd7-abd8-4526-a376-458f65018709?s=55

Security Architect with Adobe Inc.
💰 $191.7K to $345.7K a year
🏠 From the office in Seattle, WA / San Francisco / San Jose, CA, USA
→ https://kube.careers/t/b6de3faf-adb8-462a-9dd9-260446149b27?s=55

👉 Browse all 1375 Kubernetes jobs on Kube Careers https://kube.careers

Tetragon enables powerful real-time, eBPF-based security observability and runtime enforcement.

It is Kubernetes-aware and understands identities so that security event detection can be configured to individual workloads.

More: https://tetragon.io

This article introduces Azure Kubernetes Service Workload Identities and provides a step-by-step demo on enabling and implementing them in AKS.

More: https://medium.com/@swordfish291/getting-started-with-azure-workload-identities-7f8ab78da40f

Is the Kubernetes job market still hot in 2024? 🔥

We analyzed 8772 Kubernetes job listings from Q3 2024 to find out:

💰 The average worldwide Kubernetes salary is $158,134, with North America averaging $169,627.
🌎 A whopping 62% of Kubernetes jobs are in North America, with Europe at 32.5%.
👩‍💻 Software Engineers remain the most sought-after role (42%), followed by DevOps and Platform Engineers.
🏡 68% of jobs allow some form of remote work, with hybrid roles gaining popularity.
🐍 Python continues to be the most in-demand programming language for Kubernetes roles.

Want to know which skills and tools are essential to land your next Kubernetes job? Check out our detailed State of the Kubernetes Job Market report for Q3 2024: https://ku.bz/vg_wXyNvj

Permify is an open-source authorization service for easily building and managing fine-grained, scalable, and extensible access controls for your applications and services.

More: https://github.com/Permify/permify

@miamorecadenza shares their journey in building a "compute as a faucet" home lab where infrastructure becomes invisible and tasks can be executed without manual intervention.

You will learn:

- How to evaluate operating systems for your home lab — from Rocky Linux to Talos Linux, and why minimal, immutable operating systems are gaining traction.
- How to implement a three-tier storage strategy combining Longhorn (replicated storage), NFS (bulk storage), and S3 (cloud storage) to handle different workload requirements.
- How to secure your home lab with certificate-based authentication, WireGuard VPN, and proper DNS configuration while protecting your home IP address.

Watch (or listen to) it here: https://ku.bz/2kzj2MgfH

🌟 This episode is sponsored by Nutanix — innovate faster with a complete and open cloud-native stack for all your apps and data anywhere https://ku.bz/wb_0GNHnr

With @Birthmarkb "SIG-Bart" Farrell