The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier for users to use SELinux, seccomp and AppArmor in Kubernetes clusters.

More: https://github.com/kubernetes-sigs/security-profiles-operator

In this three part series, you will deep dive into Seccomp for Kubernetes workloads:

1. 7 things you should know before you even start.
2. crafting custom seccomp profiles for your applications.
3. The new syntax plus some advanced topics.

More: https://itnext.io/seccomp-in-kubernetes-part-i-7-things-you-should-know-before-you-even-start-97502ad6b6d6

KICS stands for Keeping Infrastructure as Code Secure, and it is a tool designed to find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code.

More: https://github.com/Checkmarx/kics

OWASP Kubernetes Top Ten is aimed at helping security practitioners, system administrators, and developers prioritize risks around the Kubernetes ecosystem.

This is a prioritized list of these risks backed by data.

More: https://owasp.org/www-project-kubernetes-top-ten

Master Kubernetes this November with one of our Advanced Kubernetes workshops (London or online)!

What should you expect?

- Learn how to architect and design clusters from the ground up (in the cloud or on-prem).
- Explore the Kubernetes internal component and how the system is designed with resiliency in mind.
- **Deep-dive into the networking components and observe the packets flowing into the cluster.
- Hands-on labs to test the theory with real-world scenarios!

You can sign up here: https://learnk8s.io/online-advanced-november-2022

Enabling a Kubernetes multi-tenant architecture comes with significant challenges, especially regarding cluster isolation and fair resource allocation.

In this article, you'll learn about ten essential considerations when using Kubernetes multi-tenancy.

More: https://loft.sh/blog/10-essentials-for-kubernetes-multi-tenancy

In this article, you'll learn how to grant access to users of a vcluster using DEX as a federated OpenID provider and kubelogin as a plugin for OIDC integration.

More: https://justinpolidori.it/posts/20220611_vcluster_auth

Prior to version 1.7.1, Argo Events had several HandleRoute endpoints making use of the deprecated ioutil.ReadAll().

ioutil.ReadAll() reads all the data into memory and an attacker might be able to use it and cause denial of service.

More: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31054

This CoreDNS plugin enables the filtering of queries and responses based on expressions.

Since the plugin can also refer to other policy engines to determine the action to take, you could have it integrated with OPA or Kyverno.

More: https://github.com/coredns/policy

Cosign and Connaisseur allow us to secure the Kubernetes deployment with signature verification, ensuring that our images do not change.

More: https://sysdig.com/blog/secure-kubernetes-deployment-signature-verification

🗓 Kubernetes events starting in the next 24 hours:

31 Oct 7:00 am GMT - Running arm64 and WebAssembly on Azure Kubernetes services | Coding Night NZ - 📍 Online meetup

→ See all Kubernetes events

In this tutorial, you'll learn how to write an admission controller from scratch using minikube, go, make and ko.

More: https://kubesimplify.com/diy-how-to-build-a-kubernetes-policy-engine

In this article, you will learn how to configure Sealed Secrets with ArgoCD.

More: https://dev.to/timtsoitt/argo-cd-and-sealed-secrets-is-a-perfect-match-1dbf

kubectl-exec-user lets you exec as a specified user into a Kubernetes container.

More: https://github.com/kingdonb/kubectl-exec-user

registry-creds is a tool that refreshes credentials for AWS ECR, Google Registry, & Azure Container Registry via ImagePullSecrets.

More: https://github.com/upmc-enterprises/registry-creds

In this article, you will discuss how you can secure a Kubernetes cluster using Kubescape and kube-bench.

More: https://infracloud.io/blogs/securing-kubernetes-cluster-kubescape-kubebench

What does it take to get a job as a Kubernetes engineer?

Do you need a Kubernetes certification to apply for a job?

What's the average salary for a Kubernetes engineer?

We analyzed 86 Kubernetes jobs for July, August and September and found that:

- The average Kubernetes job pays €89,729 in Europe and $139,269 in North America.
- The majority of the job listings are for Senior DevOps Engineers.
- There is a drop in remote working! Companies are asking employees to go back to the office.
- As usual, AWS, Python, Terraform, Prometheus and Jenkins 😭 are the top terms mentioned in any Kubernetes job denoscriptions.

You can read the full report here: https://kube.careers/kubernetes-trend-report-2022-q3

This repo contains the demo code of a MutatingWebhook with 2 containers:

1. The init container creates the certificates, registers the webhook, and creates a Secret.
2. The webhook container mounts the Secret and serves the endpoint.

More: https://github.com/cloud-ark/sample-mutatingwebhook

This blog post explains three vulnerabilities detected in the AWS IAM Authenticator for Kubernetes all caused by the same code line.

More: https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator

This repository contains the tool and the policy library for validating GKE clusters against configuration best practices.

More: https://github.com/google/gke-policy-automation

YaraHunter scans container images, running Docker containers and filesystems to find malware.

It uses a YARA ruleset to identify resources that match known malware signatures and may indicate that the container or filesystem has been compromised.

More: https://github.com/deepfence/YaRadare