Spotlight
Anish Kumar
This article compares IRSA and EKS Pod Identity, explains how each gives pods temporary AWS credentials, and shows Terraform examples plus a migration path.
Akhil
This case study shows how a silent 47-minute outage pushed one team to block merges in CI with an OPA policy that rejects any service without proper observability settings.
Syed Sulaiman A
This tutorial shows how to connect two Amazon EKS clusters with an Istio multi-primary, multi-network mesh and view both through centralized Kiali.
Pavankumarn
This tutorial teaches how to migrate EKS from AWS VPC CNI and kube-proxy to Cilium using blue/green nodes, WireGuard encryption, and Hubble for observability.
Tools and utilities
KubeAPT checks whether Kubernetes admission controls really block unsafe workloads, covering ValidatingAdmissionPolicies, Pod Security Admission, and reusable policy bundles.
Isola runs untrusted or AI-generated code in self-hosted Kubernetes sandboxes with gVisor isolation, controlled networking, file access, command APIs, and reusable filesystem snapshots.
kubectl-view-secret is a kubectl plugin that lists secret keys and safely decodes one or every value, with JSON, YAML, namespace, context, and interactive output options.
Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions.
WaaS creates browser-accessible Linux and Windows desktops as Kubernetes resources, with GitOps workflows, secure remote access, quotas, and OIDC and RBAC controls.
Events starting soon
November 14, 2026
Location: Bengaluru, IN
This event requires an entrance fee
November 15, 2026
Location: Şehitkamil, TR
This is a free event.
November 15, 2026
Location: Catania, IT
This is a free event.
November 15, 2026
Location: Bangkok, TH
This event requires an entrance fee
November 15, 2026
Location: Vienna, AT
This event requires an entrance fee
November 15, 2026
Location: Singapore, SG
This event requires an entrance fee
Learn from production
Ben Soleimany
This case study shows how a hidden iptables-legacy NAT rule added by Tailscale changed source IPs between Kubernetes hosts and broke etcd peer TLS, plus how the team found and removed it.
Hakan Kaya
This case study shows how an AKS-based GitOps platform gave on-premises clusters workload identity by publishing static OIDC discovery and JWKS files, avoiding API server changes after provisioning.
Ron Matsliah
This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials.
Deepakravi
This case study shows how to stabilize Harbor on VMware VKS by expanding storage, upgrading the Supervisor Service, and configuring Trivy scanning to receive vulnerability results.
Matching jobs
AI-Native Staff Product Designer, AI + Compute with Temporal Technologies
Salary: $0 to $517.18K a year
Location: remote from
Tech stack: Kubernetes, AWS, Azure, GCP, C#, Go, Java, Javascript, Python, Shell
Salary: $142.5K to $228.1K a year
Location: based in the office in Boston, MA, USA
Tech stack: Kubernetes, AWS
Data Engineer with Kraken
Salary: $86.4K to $291.5K a year
Location: remote from
Tech stack: Kubernetes, AWS, Python, SQL, Airflow
Data Engineer with Qualified Health PBC
Salary: $215K to $235K a year
Location: remote from
Tech stack: Kubernetes, AWS, Azure, GCP, SQL, Python, Snowflake, Airflow, Spark, Terraform
Data Engineer with SteerBridge
Salary: $76.5K to $291.5K a year
Location: based in the office in Vienna, VA, USA
Tech stack: Kubernetes, AWS, Azure, GCP, Docker, Python, SQL, Snowflake, Kafka, Airflow
Build something
JorelFuji
This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs.
Paul Ayegbusi
This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express.
Matt Brown
This tutorial deploys that same open-source Kubernetes security console with Helm and then checks that vulnerability, posture, policy and runtime findings are really flowing, not just that the pods started.
This tutorial shows how to use helmsniff to render thousands of Helm charts and report risky settings, like containers running as root, as a plain CSV you can analyse.
More articles
Agent Native
KubeClaw is a production-grade Helm chart for running OpenClaw AI agents on Kubernetes with secure defaults, pinned images, default-deny egress via Blocky, digest-locked upgrades, and batteries-included observability.
Kate Tsaplina
This article explains why secrets and tokens form the access system of a platform rather than plain config, and how static secrets and short-lived tokens together decide who can reach what.
4mN3s14 | Blog
This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step.
Hayeon
This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host.
