News and links on Kubernetes security curated by the @Learnk8s team Mastodon: @kubesploit@learnk8s.news
More K8s news, events, jobs →
Joined March 2021
- Tweets3.1K
- Following1
- Followers21.3K
- Likes795
This tutorial builds a Docker image with a secret, then shows how it still sits in an earlier image layer after you delete it, and pulls it back out with docker history, jq and tar
➤ ku.bz/S8r6yFdbS
This article explains how Vault piles up unexpired leases when pods keep re-authenticating with default service tokens, why that destabilises the HA cluster, and how batch tokens and shorter TTLs fix it
➤ ku.bz/Cn61TJM1G
This article asks what a container can block on its own when a dependency turns malicious, and tests nono, a capability-based sandbox that limits file and network access at runtime
➤ ku.bz/YdMc3KBZ6
This tutorial teaches how to migrate EKS from AWS VPC CNI and kube-proxy to Cilium using blue/green nodes, WireGuard encryption, and Hubble for observability
➜ ku.bz/sYGLb0l37
This article explains what an attacker can really do with leaked Kubernetes credentials, from kubeconfigs to service account tokens, and how to check the blast radius and shut it down
➤ ku.bz/ppRKVtXsb
This article explains how GKE Agent Sandbox uses gVisor to isolate untrusted AI-generated code with separate node pools, Workload Identity, RBAC, and security observability
➜ ku.bz/0dy9y1wPw
Kubesploit retweeted
KubeClaw is a production-grade Helm chart for running OpenClaw AI agents on Kubernetes with secure defaults, pinned images, default-deny egress via Blocky, digest-locked upgrades, and batteries-included observability
➜ ku.bz/CbKpPNvJq
This article walks through making a container image safe before it ever reaches the cloud, using multi-stage builds, a distroless base and Trivy scans to cut the CVE count down
➤ ku.bz/99rk_nQ-T
This article explains why secrets and tokens form the access system of a platform rather than plain config, and how static secrets and short-lived tokens together decide who can reach what
➜ ku.bz/YTvRcJgW7
Kubesploit retweeted
This week on the Learn Kubernetes Weekly:
🌐 DNS on AWS
⏳ Eventually Consistent ConfigMap Mounts
🚨 kubectl-mcp-tool Command Injection
🐘 PostgreSQL Lifecycle on Harvester
💰 Cassandra Bill: $30K to $10K
⭐️ Teleport
Read it now: kube.today/issues/206
Kubesploit retweeted
Join Graziano Casto of Akuity at LearnKube Day Salt Lake City 2026 for Kubernetes lightning talks, YAML Games, and a community reception with DJ Amin Astaneh
Learn more: learnkube.com/learnkube-day-…
This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step
➜ ku.bz/hw0Zs7JSb
Kubesploit retweeted
Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions
➜ ku.bz/KqYBl17Gv
Kubesploit retweeted
CPU and memory usage need context before you change Kubernetes requests and limits
Our new open-source Resource Review Mixin brings usage, throttling, pressure, and runtime events into Grafana
github.com/learnk8s/resource…
This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host
➜ ku.bz/2pxZf_bpJ
Kubesploit retweeted
100 pods on the same node. Node-level firewall rules don't separate them. Network policy does: east-west traffic control at the pod level. Service Mesh adds mTLS on top
Rodrigo Bersa on pod security
📺: ku.bz/dB7PDNt0v
This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials
➤ ku.bz/mdkryD536
Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production
➤ ku.bz/SWl3-LNty
Kubesploit retweeted
Kubesafe is a tool that prevents accidental execution of dangerous commands on the wrong Kubernetes cluster by providing a safety net for cluster management
➤ ku.bz/3hC23K79L
This article walks through building a Kubernetes admission webhook in Go from scratch, including the TLS trust setup and the bootstrapping deadlock nobody warns you about
➤ ku.bz/tdxnc5S4r
