Reflector is a Kubernetes addon designed to monitor changes to resources (Secrets and ConfigMaps) and reflect changes to mirror resources in the same or other namespaces.

More: https://ku.bz/wPZw27PGH

ToolHive secures Model Context Protocol (MCP) servers in Kubernetes using native features like RBAC, network policies, and StatefulSets.

It isolates servers via a proxy, blocking direct network access for enterprise-grade security.

More: https://ku.bz/cJ4HXTrnS

Sveltos installs as a controller in a management cluster, deploying add-ons and policies (Helm charts, Kustomize, raw YAML) to target clusters by label selectors and sync rules, automating multi-cluster resource management and compliance.

More: https://ku.bz/RgJVTPtfJ

This week on Learn Kubernetes Weekly 143:

🤔 Can a Simple 4-Core, 16 GB RAM Machine Reach 1000 TPS?
🧢 Cap or no cap
🔙 Reclaiming Idle GPUs in Kubernetes: A Practical Approach (and a Call for Ideas!)
💰 How We Saved $1.22 Million Annually on GCP Costs in a Few Simple Steps
🕰️ Inside Kubernetes Scheduler: What really happens before your pod lands on a node

Read it now: https://learnkube.com/issues/143

⭐️ This newsletter is brought to you by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person, or remote training https://learnkube.com/training

argocd-vault-plugin is an Argo CD plugin that retrieves secrets from Secret Management tools and injects them into Kubernetes.

More: https://ku.bz/0Gz8zfVch

This guide will teach you how to integrate HashiCorp Vault with Kubernetes Secrets CSI Driver, configure Kubernetes authentication, and create SecretProviderClass resources for secure secret management.

More: https://ku.bz/FSg9XsTZc

kube-advisor.io runs an agent in your cluster to auto-detect misconfigs and best practice violations in real time; supports Kyverno for custom checks.

More: https://ku.bz/WVcV9HKN7

In Kubernetes, containers typically start with root privileges.

This happens because, by default, container processes run as UID 0 unless overridden. While convenient during development, it introduces unnecessary risk in production environments.

If an attacker compromises the container, root access increases the likelihood of privilege escalation to the host.

Our latest article "From Linux Primitives to Kubernetes Security Contexts" demystifies these concepts.

Read the full article: https://learnkube.com/security-contexts

This article explains how to use offensive container security techniques for Docker and Kubernetes, covering misconfigurations, attack paths, and defenses.

More: https://ku.bz/WKmQXwcMN

Alessandro from IBM Research how his team transformed their chaotic bare-metal clusters into a well-governed, self-service platform for AI and scientific workloads.

You will learn:

- How to implement GitOps workflows that reduce administrative burden while maintaining governance and visibility
- Practical policy enforcement strategies using Kyverno to prevent GPU monopolization, block interactive pod usage, and automatically inject scheduling constraints
- Fair resource sharing techniques with Kueue to manage scarce GPU resources across different hardware types

Watch (or listen to) it here: https://ku.bz/5sK7BFZ-8

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Udinese Lead Press Officer" Farrell

Jim Bugwadia, Co-Founder & CEO @ Nirmata, explains why policy as code is transforming Kubernetes resource management.

Drawing a parallel to how infrastructure as code revolutionized configuration management, Jim positions policy as code as the critical building block for platform engineering teams to automate security guardrails rather than enforcing rigid processes.

Watch the full interview: https://ku.bz/hYZXTmPV9

This interview is a reaction to Alexandre Souza's episode https://ku.bz/z2Vj9PBYh

kubeconfig-ca-fetch is a tool that aggregates CA certs from multiple hardcoded clusters into a single kubeconfig using GitHub OIDC.

More: https://ku.bz/2MPKkZ5Bj

This week on Learn Kubernetes Weekly 144:

✅ Modern Kubernetes: can we replace Helm?
💰 How We Saved 80% on Our Observability Bill!
🥷 Offensive Container Security: Techniques, Misconfigurations, and Attack Paths
💡 Scaling Kubernetes Smarter with Karpenter
✈️ ECR to OCIR: Event-driven Docker Image Updates

Read it now: https://learnkube.com/issues/144

⭐️ This newsletter is brought to you by Testkube — because if your app is Kubernetes-native, your testing should be too. Run any kind of test automation with the help of the platform built for it https://ku.bz/JqgJVcfRh

This tutorial teaches how to implement SPIFFE/SPIRE for cloud-native workload identity management and integrate with Istio for mutual TLS and authorization policies.

More: https://ku.bz/HYVTDDcVz

kubelet-csr-approver is a hardened Kubernetes controller that auto-approves kubelet-serving CSRs only after verifying strict node identity rules—regex-matched hostnames, IP prefix constraints, username matching, DNS resolution, and X.509 CN checks.

More: https://ku.bz/-HVF5sB0h

Master Kubernetes with LearnKube's Advanced Kubernetes workshop!

What should you expect?

- Learn how to architect and design clusters from the ground up (in the cloud or on-prem).
- Explore the Kubernetes internal component and how the system is designed with resiliency in mind.
- Deep-dive into the networking components and observe the packets flowing into the cluster.
- Hands-on labs to test the theory with real-world scenarios!
- And more.

The next course starts in September: https://learnkube.com/training

We also run in-person courses and private training: https://learnkube.com/corporate-training

This article explains how to use Transaction Tokens (TraTs) and the Tokenetes framework to securely propagate user identity and request context across microservices in Kubernetes.

More: https://ku.bz/YJ8vdTDvX

Harsha Koushik, a Security Researcher and Technical Product Manager at Palo Alto Networks, discusses the evolution and challenges of Alpine Linux.

He points out issues such as DNS resolution problems and inefficient memory allocation using a best-fit model, which compromises system stability.

He suggests that the goal should be to maintain a stable system with a reduced attack surface, citing Chainguard's Wolfi as a potential alternative that balances minimalism and stability effectively.

Watch the full episode: https://ku.bz/n_sJ04xMY

net-debug is a toolbox container with tcpdump, socat, iperf, dig, and more, built for Kubernetes debugging.

More: https://ku.bz/mC-nblk2l

Data centers consume over 4% of global electricity, and due to AI workloads, this number is projected to triple in the next few years.

Dave discusses how he built a Kubernetes scheduler that makes scheduling decisions based on real-time carbon intensity data from power grids.

You will learn:

- How carbon-aware scheduling works
- Building custom Kubernetes schedulers using the scheduler plugin framework
- Energy measurement strategies - Approaches for tracking power consumption across CPUs, memory, and GPUs

Watch (or listen to) it here: https://ku.bz/zk2xM1lfW

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Trello Expert" Farrell

KubeBuddy audits your Kubernetes clusters from PowerShell.

It checks node health, pods, events, RBAC, and AKS best practices, then outputs clean HTML or text reports.

More: https://ku.bz/85lvgDJpD