Thinking on cybersecurity, compliance, and managed defence - from the CyberCheck team.
Enabling encryption at rest for etcd is a genuinely important Kubernetes security control, and it’s also frequently treated as a complete solution to Kubernetes secrets security when it addresses only one specific threat: someone gaining direct access to the etcd data store or its underlying disk. Most real-world Kubernetes secrets exposure happens through paths that … Read more
Kubernetes admission controllers give teams a powerful mechanism for enforcing security and operational policy before resources are ever created in a cluster. Yet many organizations underuse this capability. They rely instead on after-the-fact detection and remediation for violations that admission control could have prevented entirely. What Admission Controllers Do Admission controllers intercept requests to the … Read more
Kubernetes clusters operate with default-allow network behavior out of the box. Pods can communicate freely with each other unless network policies are explicitly configured to restrict that communication – a default that catches many organizations by surprise once they understand its real security implications. Why Kubernetes Defaults to Open Pod-to-Pod Communication Kubernetes defaults to allowing … Read more
Kubernetes native secrets provide a convenient built-in mechanism for managing sensitive configuration data, but security-conscious organizations increasingly recognize that the default Kubernetes secrets approach carries real limitations that make it insufficient for security-sensitive production use without additional, deliberate hardening. What Kubernetes Native Secrets Provide Kubernetes secrets offer a built-in mechanism for storing and injecting sensitive … Read more
Kubernetes role-based access control, commonly known as RBAC, provides powerful, granular access management capability, but its own flexibility and complexity make RBAC misconfiguration a common source of Kubernetes clusters quietly granting considerably more access than administrators intended or realized. Why Kubernetes RBAC Complexity Invites Misconfiguration Kubernetes RBAC offers considerable configuration flexibility – roles, cluster roles, … Read more
Container escape vulnerabilities – flaws that let an attacker break out of a container’s intended isolation boundary and access the underlying host system – represent one of the more serious, high-impact vulnerability classes in containerized environments. Understanding how these work, and what mitigates the real risk, matters for anyone running production containerized workloads at any … Read more
Kubernetes adoption has moved fast, and security practices have, in a lot of organizations, not kept pace with that speed. Teams that would never dream of deploying a web server with default credentials will happily spin up a cluster with permissive default configurations left entirely unexamined, simply because Kubernetes security is more complex than traditional … Read more