Topic: security

2026

1. August 17, 202623 min read

   Kubernetes security in production · 02/04

   Network policies and Cilium: building a defensible default-deny

   The NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.

2. August 17, 202618 min read

   Kubernetes security in production · 01/04

   Kubernetes RBAC: the foundations, and the pitfalls that survive an audit

   Every one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.

3. August 17, 202617 min read

   Kubernetes security in production · 04/04

   Runtime security: Falco and Tetragon, and how to actually choose

   Falco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.

4. August 17, 202617 min read

   Kubernetes security in production · 03/04

   Supply chain security: Sigstore, SBOM, admission control

   Kubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.

5. August 17, 202614 min read

   VCF identity and zero trust · 03/03

   vDefend Distributed Firewall: zero trust at the workload level

   Least-privilege policy per vNIC, built on dynamic groups and tags rather than IP addresses — and the honest boundary where federated identity stops and the firewall starts.

6. August 17, 202616 min read

   VCF identity and zero trust · 01/03

   VCF Identity Broker: where VCF 9.1 single sign-on actually stops

   VCF Identity Broker federates login across the VCF consoles, but the documented perimeter is narrower than the pitch. We map what it covers, what stays local, and the break-glass path.

7. August 17, 202616 min read

   VCF identity and zero trust · 02/03

   Federating VCF identity: Okta, Entra ID, and the generic path

   Four identity providers are documented by name, each with its own protocol path. Everything else goes through generic SAML 2.0 — a route that works without being a support statement.

8. June 9, 20268 min read

   What's new in VCF 9.1 · 04/04

   VCF 9.1: security & resilience — live patching and anti-ransomware

   Live Patching for ESX with no maintenance window, continuous compliance, and on-prem anti-ransomware recovery. What changes for your recovery plan.