Stop Giving Everyone Permanent kubectl Access to Production
Production access should be designed around real tasks, time-limited privileges, and an emergency path—not a shared admin kubeconfig.
Read more →7 posts
Production access should be designed around real tasks, time-limited privileges, and an emergency path—not a shared admin kubeconfig.
Read more →Pod hardening and network policies matter. But an overprivileged identity can give an attacker control of the entire cluster.
Read more →What a real Kubernetes cluster audit actually checks, how findings should be prioritized, what a useful audit report looks like, and when it's...
Read more →A practical approach to rolling out default-deny NetworkPolicy in a live cluster — how the allow-list model actually works, the rollout sequence...
Read more →A hands-on guide to auditing Kubernetes RBAC — the exact kubectl commands to find cluster-admin bindings, wildcard permissions, and...
Read more →A working security checklist for production Kubernetes clusters — securityContext, Pod Security Standards, secrets, image provenance, and the...
Read more →A practical checklist covering the security, resource, and networking issues I find most often when auditing production Kubernetes clusters.
Read more →