Field notes
Cover: rootless nodes shrink the blast radius of container breakouts by keeping node components out of host root. Kubernetes v1.37 promotes KubeletInUserNamespace—better known as rootless mode—to beta. For platform and security teams, that is more than…
Kubernetes security conversations in 2026 increasingly emphasize stronger node isolation: pod user namespaces, rootless-friendly node designs, tighter kubelet authorization, and workload identity that does not lean on overly powerful node roles. Operators do not need to…
September Patch Tuesday arrives while many teams are still clearing August debt and preparing for autumn freezes. Mixed Windows and Linux estates make prioritization harder: domain controllers, browser engines, container runtimes, and kernel CVEs compete for…
Build agents and data-science hosts are prolific network clients. They pull packages, container images, datasets, and model weights—and they often run with credentials that can reach production object storage or cloud APIs. Without egress controls, a…
Infrastructure as code made cloud changes reviewable in theory. In practice, many organizations still merge Terraform, CloudFormation, Pulumi, or Helm changes with rubber-stamp habits. Policy as code, plan review discipline, and drift detection only help if…
With pod user namespaces at GA in Kubernetes v1.36, the question shifts from "is it real?" to "how do we adopt without breaking fleets?" This post outlines a post-GA adoption plan: compatibility testing, Pod Security alignment,…
Kubernetes v1.36 graduates pod user namespaces to General Availability. For workload owners and platform teams, that is a concrete isolation upgrade: with hostUsers: false, a container's root can map to an unprivileged user on the node,…
Change freezes feel safe. They also hide risk: delayed security patches, piled-up releases, and Friday-night catch-up deployments when the freeze finally lifts. Growing engineering organizations need a better bargain—safe change windows that reduce blast radius without…
Kubernetes Services that accept attacker-influenced external IPs—or LoadBalancer status updates from over-privileged identities—enable long-standing man-in-the-middle classes of risk inside clusters. Multi-tenant platforms amplify the issue. This article is operational hygiene guidance: inventory, admission, RBAC, and monitoring…
Security tooling succeeds until cardinality and cost explode. Endpoint sensors, cloud trails, DNS logs, Kubernetes audit events, and WAF records grow faster than budgets. Without capacity planning, teams drop data silently, overrun SIEM spend, or drown…