Kubesploit

News and links on Kubernetes security curated by the @Learnk8s team
Mastodon: @[email protected]

[Kubesploit @kubesploit]

This tutorial builds a Docker image with a secret, then shows how it still sits in an earlier image layer after you delete it, and pulls it back out with docker history, jq and tar

➤ https://t.co/096npiZku7

[Kubesploit @kubesploit]

This article explains how Vault piles up unexpired leases when pods keep re-authenticating with default service tokens, why that destabilises the HA cluster, and how batch tokens and shorter TTLs fix it

➤ https://t.co/UXqQ7cXwAk

[Kubesploit @kubesploit]

This article asks what a container can block on its own when a dependency turns malicious, and tests nono, a capability-based sandbox that limits file and network access at runtime

➤ https://t.co/PmDZK1ayLX

[Kubesploit @kubesploit]

This tutorial teaches how to migrate EKS from AWS VPC CNI and kube-proxy to Cilium using blue/green nodes, WireGuard encryption, and Hubble for observability

➜ https://t.co/qjo85PP7aa

[Kubesploit @kubesploit]

This article explains what an attacker can really do with leaked Kubernetes credentials, from kubeconfigs to service account tokens, and how to check the blast radius and shut it down

➤ https://t.co/SNa0ovS6Nf

[Kubesploit @kubesploit]

This article explains how GKE Agent Sandbox uses gVisor to isolate untrusted AI-generated code with separate node pools, Workload Identity, RBAC, and security observability

➜ https://t.co/GmubDzDNPO

[Kube Builders @KubeBuilders]

KubeClaw is a production-grade Helm chart for running OpenClaw AI agents on Kubernetes with secure defaults, pinned images, default-deny egress via Blocky, digest-locked upgrades, and batteries-included observability

➜ https://t.co/HFlnEKEhe0

[Kubesploit @kubesploit]

This article walks through making a container image safe before it ever reaches the cloud, using multi-stage builds, a distroless base and Trivy scans to cut the CVE count down

➤ https://t.co/Wf0oF1nBjf

[Kubesploit @kubesploit]

This article explains why secrets and tokens form the access system of a platform rather than plain config, and how static secrets and short-lived tokens together decide who can reach what

➜ https://t.co/2l8WYwD8eG

[LearnKube @learnk8s]

This week on the Learn Kubernetes Weekly:

🌐 DNS on AWS
⏳ Eventually Consistent ConfigMap Mounts
🚨 kubectl-mcp-tool Command Injection
🐘 PostgreSQL Lifecycle on Harvester
💰 Cassandra Bill: $30K to $10K

⭐️ Teleport

Read it now: https://t.co/nRztP79HNr

[KubeFM @K8sFM]

Join Graziano Casto of Akuity at LearnKube Day Salt Lake City 2026 for Kubernetes lightning talks, YAML Games, and a community reception with DJ Amin Astaneh

Learn more: https://t.co/sfmg8TYMt5

[Kubesploit @kubesploit]

This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step

➜ https://t.co/m6XrRwe76j

[LearnKube @learnk8s]

Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions

➜ https://t.co/D6FnI2Lejz

[LearnKube @learnk8s]

CPU and memory usage need context before you change Kubernetes requests and limits

Our new open-source Resource Review Mixin brings usage, throttling, pressure, and runtime events into Grafana

https://t.co/vSlCZsu5UA

[Kubesploit @kubesploit]

This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host

➜ https://t.co/gzddHzp7fh

[KubeFM @K8sFM]

100 pods on the same node. Node-level firewall rules don't separate them. Network policy does: east-west traffic control at the pod level. Service Mesh adds mTLS on top

Rodrigo Bersa on pod security

📺: https://t.co/Nedj3TqH3b

[Kubesploit @kubesploit]

This case study shows how a team ran ServiceNow's MID Server on EKS as a StatefulSet and faked the EC2 metadata service so the agent would accept IRSA credentials

➤ https://t.co/pzCm0U0AL1

[Kubesploit @kubesploit]

Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production

➤ https://t.co/mbECReSypH

[Kube Builders @KubeBuilders]

Kubesafe is a tool that prevents accidental execution of dangerous commands on the wrong Kubernetes cluster by providing a safety net for cluster management

➤ https://t.co/0SQy9yKPP5

[Kubesploit @kubesploit]

This article walks through building a Kubernetes admission webhook in Go from scratch, including the TLS trust setup and the bootstrapping deadlock nobody warns you about

➤ https://t.co/NNugWoUZSK