Spotlight
Mohamed Rasvi
This tutorial explains how to build a PCI-DSS focused GKE security framework using:
Rodrigo Campos Catelin
This article explains how Kubernetes user namespaces are implemented through pod UID/GID range allocation, idmap mounts, containerd, runc, and safeguards against privilege escalation.
Lormenskyjean
This article explains how Falcon Shield extends CrowdStrike security into SaaS applications through posture management, identity governance, OAuth visibility, permission drift detection, and identity threat response.
Mohamed Rasvi
This tutorial explains how to build a PCI-DSS focused GKE security framework using Workload Identity, Secret Manager, NetworkPolicy, zero trust networking, Binary Authorization, audit logging, and secure access patterns.
Tools and utilities
This tutorial shows how to use the RBAC Overview OpenShift console plugin to audit users, service accounts, role bindings, cluster admins, and SCC access.
Nomos governs AI agent actions for Claude Code, Codex, Cursor, and MCP by enforcing allow, deny, or approval decisions before file, shell, Kubernetes, GitHub, HTTP, or secret access runs.
Copy Fail Destroyer runs on Kubernetes nodes to detect and remediate Copy Fail and Dirty Frag by probing vulnerable kernel modules, unloading them, exposing metrics, and supporting Helm or ArgoCD deployment.
k8scout maps realistic Kubernetes escalation paths from a compromised pod to cluster-admin, node access, secret theft, or cloud IAM takeover, with graph output and reviewer mode.
Copy Fail Blocker deploys a privileged DaemonSet that blocks AF_ALG and AF_RXRPC socket creation cluster-wide to mitigate Copy Fail and similar Linux kernel privilege-escalation paths.
Events starting soon
August 12, 2026
Location: Virginia Beach, VA, USA
This is a free event.
August 12, 2026
Location: Docklands, AU
This is a free event.
August 13, 2026
This is a virtual event
This is a free event.
August 13, 2026
Location: Hamburg, DE
This is a free event.
August 13, 2026
Location: Seattle, WA, USA
This is a free event.
August 15, 2026
Location: Rio de Janeiro, BR
This event requires an entrance fee
Learn from production
Gleb Wam
This case study explains how a privileged Kubernetes pod with host access can lead to container escape, control plane disruption, service account theft, and cloud resource takeover.
Alex
This case study explains how a Kubernetes secrets audit exposed weak secret handling and forced a move toward safer secret management.
It covers encoded secrets, RBAC, encryption, external secret stores, and audit-ready controls.
Matt Camp
This case study shows how Unitary built Osmia, an open-source orchestration layer on EKS to run autonomous AI coding agents safely at scale using pod isolation, Karpenter, IRSA-based secrets, and real-time trajectory scoring.
Fabián Sellés Rosa
This case study shows how upgrading to Kubernetes 1.34 caused KIAM pods to fail due to service account token expiration changes, revealing that legacy clients using long-lived tokens now expire after 24 hours instead of 90 days.
Matching jobs
DevOps Engineer with Mark43
Salary: $155K to $170K a year
Location: remote from
Tech stack: Kubernetes, Docker, Terraform
DevOps Engineer with RobCo
Salary: US$70.74K to US$440K a year
Location: based in the office in Munich, DE
Tech stack: Kubernetes, AWS, Go, Python, Terraform, Datadog, Grafana, Prometheus
Site Reliability Engineer with MyFitnessPal
Salary: $120K to $165K a year
Location: remote from
Tech stack: Kubernetes, AWS, Docker, Go, Python, Typescript, Terraform, GitHub Actions, Datadog
AI Enterprise Technical Program Manager with Redhorse Corporation
Salary: $37 to $485.65K a year
Location: based in the office in Arlington, VA, USA
Tech stack: Kubernetes, AWS, Azure, Docker, Spark
Commercial Account Executive with Vantage
Salary: $100K to $200K a year
Location: remote from
Tech stack: Kubernetes, AWS, CircleCI, Datadog
Build something
Lakhan Solanki
This tutorial explains how to sign and verify Docker images in Amazon ECR using Cosign and AWS KMS.
It also shows how trusted image enforcement can fit into EKS and Kyverno-based supply chain security.
Kenrick Tandrian
This tutorial explains why standard GKE Ingress breaks under Istio STRICT mTLS and shows how to replace it with an Istio Ingress Gateway, Gateway resource, and VirtualService.
All Things In Cloud
This tutorial shows how to modernize Kyverno policies with CEL using practical Kubernetes security examples like namespace rules, image checks, service account tokens, and safer policy testing.
Shubham Katara
This tutorial shows how to connect on-prem Kubernetes workloads to Google Cloud without service account keys using Workload Identity Federation, OIDC, Terraform, Kyverno, and IAM attribute conditions.
More articles
Matt Brown
This article explains how to build a Kubernetes security console that turns CRD-based security findings and runtime events into one MCP-backed triage surface.
Juliet Security Team
This article explains why Kubernetes PSS Restricted and RuntimeDefault seccomp did not block AF_ALG access during Copy Fail testing.
It shows why kernel attack surface still matters even when pods follow strict runtime defaults.
Tracenyx Team
This article explains how Kubernetes zero-trust egress policy can contain the Axios npm supply-chain attack by blocking C2 traffic, data exfiltration, and lateral movement from compromised pods.
Guo Xiang Ng
This article explains four Kubernetes isolation patterns for AI agents: no exec, sidecar exec, separate exec pod, and ephemeral job dispatchers, with OpenShift-validated threat modeling.
