Conftest lets you enforce security/compliance rules on Kubernetes, Terraform, and other configs using OPA’s Rego.

More: https://ku.bz/Cq4x8tmnM

This article explains how to understand the limitations of Kubernetes' allowPrivilegeEscalation: false flag and its failure to prevent all privilege escalation methods.

More: https://ku.bz/RpcSdbpgK

Frédéric, Senior SRE at BlaBlaCar, shares how his team solved the cold start problem for their 1,500 Java microservices using Istio's warm-up capabilities.

You will learn:

- Why Java applications struggle with cold starts and how JIT compilation affects initial request latency
- How Istio's warm-up feature works to gradually ramp up traffic to new pods
- Why other common solutions fail, including resource over-provisioning, init containers, and tools like GraalVM
- Real production impact from implementing this solution, including dramatic improvements in message moderation SLOs at BlaBlaCar's scale of 4,000 pods

Watch (or listen to) it here: https://ku.bz/grxcypt9j

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Javanoscript troll humor" Farrell

watchall monitors your Kubernetes cluster, snapshots all resource changes into timestamped YAML files, redacts secrets, and lets you diff resource history offline via a deltas subcommand.

More: https://ku.bz/WncbdWtvp

This week on Learn Kubernetes Weekly 147:

🐣 Inside a Pod’s Birth: Veth Pairs, IPAM, and Routing with Kindnet CNI
✂️ How We Cut Cross-AZ Traffic Costs Between Kubernetes Services in AWS Using Istio
🙅‍♀️ allowPrivilegeEscalation: false: The Kubernetes Security Flag With a Hidden Catch
🏞️ Kubernetes v1.33: Streaming List responses
⌛️ Fine-grained control with configurable HPA tolerance

Read it now: https://learnkube.com/issues/147

⭐️ This interview is brought to you by vCluster Labs — get the free eBook "GPU-enabled Platforms on Kubernetes". Learn GPU isolation, security patterns, and production architectures for AI infrastructure https://ku.bz/ZQXLKbwL7

KubernetesEnumerationTool audits clusters for exploitable misconfigs, missing best practices, and RBAC overreach.

It identifies weak points like privileged pods, hostIPC, insecure tokens and tests node-level access via PowerShell modules.

More: https://ku.bz/-zW_QZVKM

This tutorial shows how to restrict access to Kubernetes services without a VPN using oauth2-proxy with ingress-nginx.

More: https://ku.bz/z67cDR8Fg

This repository demonstrates CVE-2024-3094, the backdoor discovered in xz utils versions 5.6.0+.

It provides a Docker container with the vulnerable Debian package and a patched liblzma library to reproduce the SSH authentication bypass exploit.

More: https://ku.bz/4K_lDB_ff

This tutorial sets up Vault's database secrets engine in AKS to generate short-lived Postgres credentials on demand, using ExternalSecrets and VaultDynamicSecret to sync them into native Kubernetes Secrets.

More: https://ku.bz/MbNs69CsB

Jorrick shares how his team of eight students built a complete predictive scaling system for Kubernetes clusters using machine learning.

You will learn:

- How to implement predictive scaling using Prophet ML model, Prometheus metrics, and custom APIs to forecast Kubernetes workload patterns
- The Node Ranking Index (NRI) - a unified metric that combines CPU, RAM, and request data into a single comparable number for efficient scaling decisions
- Real-world implementation challenges, including data validation, node startup timing constraints, load testing strategies, and the importance of proper research

Watch (or listen to) it here: https://ku.bz/clbDWqPYp

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Kidnapped by an artist" Farrell

This repo demonstrates CVE-2024-0132, a container escape in NVIDIA Container Toolkit.

It swaps directory contents during validation, causing the toolkit to mount the entire host filesystem into the container instead of just a library file.

More: https://ku.bz/0Z5QPQl_N

Shahar Azulay, Co-Founder and CEO at groundcover, explains how observability and security have become increasingly interconnected in Kubernetes environments.

He discusses how eBPF technology blurs the line between these domains, allowing groundcover to provide security insights through observability features like API mapping that identifies encryption status and PII exposure. Shahar also highlights the critical security considerations for observability data itself, explaining why groundcover uses a "bring your own cloud" approach rather than the SaaS model common among competitors.

Watch the full interview: https://ku.bz/qt-j8gMlS

This week on Learn Kubernetes Weekly 148:

🙈 Everything was fine until Kubernetes said ‘No more CPU’
🫄 Kubernetes Capacity Planning: Getting It Wrong Is Step One (And That’s Okay!)
♻️ Kubernetes v1.33: Updates to Container Lifecycle
📕 From CI to Kubernetes Catalog: Building a Composable Platform with GitOps and vCluster
🍀 Orchestrating a Greener Cloud: Carbon-Aware Kubernetes Scheduling with Liqo and Karmada

Read it now: https://learnkube.com/issues/148

⭐️ This newsletter is brought to you by Testkube — Keep your existing API, performance, and security testing tools. Run it at scale in Kubernetes https://ku.bz/Zfrty_fcC

This article explains how to configure Kubernetes SecurityContext settings at the pod and container levels to enforce security policies like non-root execution, volume permissions, and Linux capabilities.

More: https://ku.bz/nJ8Zkh6x9

kubeseal-convert is a tool for importing secrets from pre-existing secrets management systems (e.g. Vault, Secrets Manager) into a SealedSecret.

More: https://ku.bz/fQPD8MvbX

This article explains how to configure Istio to observe encrypted and unencrypted egress traffic in Kubernetes using TLS termination, origination, and certificate management.

More: https://ku.bz/rc3DypN0f

A 45-minute production outage at Weaveworks changed how we deploy software forever.

We just released the first episode of "The Making of Flux," a four–part KubeFM original series in which we interview the people who built, maintained, and deployed Flux at scale.

Episode 1 features Alexis Richardson (former Weaveworks CEO), Chris Aniszczyk (CNCF CTO), and Andrew Martin (ControlPlane CEO) discussing how that production disaster led to GitOps, what CNCF graduation actually means, and how Flux is thriving.

You'll hear about the technical decisions, governance challenges, and production failures that shaped the project and what these practitioners learned the hard way.

Thanks to our guests for their candor, to ControlPlane for making this series possible, and to @Birthmarkb.

Episode 1 is live now: https://ku.bz/5Sf5wpd8y

P.S. If you're going to KubeCon, FluxCon is on November 11th in Salt Lake City https://ku.bz/L843kg0CK

kps-zeroexposure is a helm chart that fixes unhealthy or missing control-plane metrics targets in kube-prometheus-stack by deploying a secure Prometheus Agent as a DaemonSet.

More: https://ku.bz/jtT5DjB6h

Thibault shares the technical details of debugging a complex VPA failure at Adevinta, where webhook timeouts triggered continuous pod evictions across their multi-tenant Kubernetes platform.

You will learn:

- VPA architecture deep dive - How the recommender, updater, and mutating webhook components interact
- Hidden Kubernetes limits - How default QPS and burst rate limits in the Kubernetes Go client can cause widespread failures
- Monitoring strategies for autoscaling - What metrics to track for webhook latency and pod eviction rates to catch similar issues

Watch (or listen to) it here: https://ku.bz/rf1pbWXdN

🌟 This episode is brought to you by Testkube—where teams run millions of performance tests in real Kubernetes infrastructure. From air-gapped environments to massive scale deployments, orchestrate every testing tool in one platform https://ku.bz/lnxYK3s0L

With @Birthmarkb "Reading Rainbow" Farrell

Jim Bugwadia, Co-Founder & CEO @ Nirmata, discusses the concerning statistic that 71% of Kubernetes security vulnerabilities stem from misconfigurations (according to a 2021 Red Hat report).

He explains how policy engines like Kyverno enable teams to not only "shift left" but also "shift down" by building security directly into the platform layer. Jim shares how Nirmata customers implement this approach by enforcing policies upfront, scanning in pipelines, and blocking problematic configurations at admission control points, resulting in cleaner Kubernetes environments.

Watch the full interview: https://ku.bz/hYZXTmPV9

This article explains the governance differences between AWS Config and Kubernetes native policy engines and their complementary roles in cloud environments.

More: https://ku.bz/ttgXTYdrZ