Topic: k8s-security-prod

2026

1. August 17, 202623 min read

   Kubernetes security in production · 02/04

   Network policies and Cilium: building a defensible default-deny

   The NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.

2. August 17, 202618 min read

   Kubernetes security in production · 01/04

   Kubernetes RBAC: the foundations, and the pitfalls that survive an audit

   Every one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.

3. August 17, 202617 min read

   Kubernetes security in production · 04/04

   Runtime security: Falco and Tetragon, and how to actually choose

   Falco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.

4. August 17, 202617 min read

   Kubernetes security in production · 03/04

   Supply chain security: Sigstore, SBOM, admission control

   Kubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.