Sealed Secrets provides declarative Kubernetes Secret Management in a secure way.

Since the Sealed Secrets are encrypted, they can be safely stored in a code repository.

More: https://ku.bz/17NJS0d9k

Harsha Koushik, a Security Researcher and Technical Product Manager at Palo Alto Networks, discusses the role of the shell in system interaction and security.

He explains that while the shell is a user-friendly interface for interacting with a system, it functions as an abstraction layer, making system calls similar to those made by application libraries.

From a security perspective, he highlights that removing the shell does not inherently protect against attacks, as the same system calls can be executed through different libraries.

Watch the full episode: https://ku.bz/n_sJ04xMY

This is a library of policies based on Kubescape controls ready for use with Kubernetes Validating Admission Policies.

More: https://ku.bz/4fkMXZ3R4

helmper is a Go program that reads Helm Charts from remote OCI registries and pushes the charts container images to your registries with optional OS-level vulnerability patching.

More: https://ku.bz/K9cKPh4gl

Kubernetes v1.33 introduces default user namespaces, enabling developers to enhance container security by isolating container user IDs from host systems with a simple opt-in, preventing privilege escalation and potential breakout attacks.

More: https://ku.bz/VcF4QPnv_

Ory Kratos is the developer-friendly, security-hardened and battle-tested Identity, User Management and Authentication system for the Cloud.

It is designed to run best on a Container Orchestration system such as Kubernetes.

More: https://ku.bz/PdzGBDwjh

This week on Learn Kubernetes Weekly 141:

💣 Kubernetes failure stories
👩‍🏫 YAML templating was a mistake
✍️ Defining and Implementing Effective SLOs and SLIs for ArgoCD
📈 Scaling to the future: Kubernetes reimagined with Graviton processors
🔎 Tracing Strategies For LLMs Running On Google Cloud Run

Read it now: https://learnkube.com/issues/141

⭐️ This newsletter is brought to you by Dynatrace - Transform complexity into your greatest asset AI-powered observability https://ku.bz/4KNlNJYz9

The article explains how attackers can exploit Kubernetes clusters by leveraging pod vulnerabilities to gain filesystem access, execute shell commands, escape containers, and exfiltrate tokens for potential cluster-admin escalation.

More: https://ku.bz/L4Pl5-zHl

k8s-remix is an operator to compose secrets with the same flexibility as a pod env spec field.

It monitors changes to configmaps and secrets mentioned in the dataFrom field, and triggers an update whenever these resources are updated.

More: https://ku.bz/vpTfmB6mP

The tutorial explains how to securely integrate AWS Secrets Manager with Kubernetes using the External Secrets Operator (ESO), automating secret synchronization via YAML configurations and IAM credentials to eliminate hardcoded secrets.

More: https://ku.bz/TR1h6vSwl

The ClusterSecret operator keeps matching namespaces updated with secrets:

- New matching namespaces receive the secret automatically. - Changes to the ClusterSecret update all related secrets, and deleting it also removes all cloned secrets.

More: https://ku.bz/L452YC-Mp

This tutorial covers east-west routing configuration utilizing CoreDNS, Traefik, cert-manager, and trust-manager for domain resolution and secure certificate management.

More: https://ku.bz/QfzB7zPcf

This week on Learn Kubernetes Weekly 142:

🐳 How Kubernetes Runs Containers: A Practical Deep Dive
0️⃣ Why Scale to Zero?
💰 How We Saved 80% on Our Observability Bill!
📝 Kubernetes configuration and infrastructure as code taxonomy
🏎️ Kubernetes performance tuning: eviction thresholds

Read it now: https://learnkube.com/issues/142

⭐️ This newsletter is brought to you by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person, or remote training https://learnkube.com/training

Kyverno is a policy engine designed for Kubernetes.

It can validate, mutate, and generate configurations using admission controls and background scans.

Kyverno policies are Kubernetes resources and do not require learning a new language.

More: https://ku.bz/swJ_5DtbJ

This article explains how Kubernetes handles Linux capability names inconsistently, with behavior differing between container runtimes like containerd and CRI-O.

More: https://ku.bz/Fk3B8xWbr

Learn how UiPath replaced mutating webhooks with a Helm library solution, enabling flexible cross-service configuration management in Kubernetes without cluster-wide permissions.

More: https://ku.bz/frf79NxRC

KSOPS is a kustomize exec plugin for SOPS encrypted resources.

KSOPS can be used to decrypt any Kubernetes resource, but is most commonly used to decrypt encrypted Kubernetes Secrets and ConfigMaps.

More: https://ku.bz/615H3TNYJ

Hillai Ben-Sasson and Ronen Shustin, Security Researchers at Wiz, explain how gaining code execution on a node can allow attackers to exploit kubelet credentials to access sensitive cluster resources.

This issue highlights the risks of overly powerful service accounts, even on isolated nodes, as they can inadvertently expose sensitive data from other customers.

Watch the full episode: https://ku.bz/yr16qNTFx

Reflector is a Kubernetes addon designed to monitor changes to resources (Secrets and ConfigMaps) and reflect changes to mirror resources in the same or other namespaces.

More: https://ku.bz/wPZw27PGH

ToolHive secures Model Context Protocol (MCP) servers in Kubernetes using native features like RBAC, network policies, and StatefulSets.

It isolates servers via a proxy, blocking direct network access for enterprise-grade security.

More: https://ku.bz/cJ4HXTrnS

Sveltos installs as a controller in a management cluster, deploying add-ons and policies (Helm charts, Kustomize, raw YAML) to target clusters by label selectors and sync rules, automating multi-cluster resource management and compliance.

More: https://ku.bz/RgJVTPtfJ