Field notes
Cloud administrator workstations are high-value targets. A single phishing email on a daily-driver laptop can yield console cookies, API keys, and enough session material to alter IAM or plant persistence. Privileged Access Workstations (PAWs)—hardened, dedicated environments…
Infrastructure as code made cloud changes reviewable in theory. In practice, many organizations still merge Terraform, CloudFormation, Pulumi, or Helm changes with rubber-stamp habits. Policy as code, plan review discipline, and drift detection only help if…
Machine-learning platforms grew up as research convenience layers: tracking servers, model registries, feature stores, and notebook hosts that made experimentation easy. That convenience often arrived with default network exposure, weak authentication, and service identities that can…
Internal platforms increasingly execute untrusted or lightly trusted code: plugin sandboxes, customer-submitted jobs, research notebooks with shell access, and automated evaluation harnesses. Isolation is no longer optional. This evergreen guide covers practical boundaries for compute, identity,…
On 1 June 2026, the Kubernetes Security Response Committee updated CVE records for older unfixed issues so scanners and operators see accurate affected-version information. The project blog "Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs"…
Kubernetes v1.36 made pod user namespaces generally available, and that is worth adopting. It is also worth refusing hype. User namespaces are necessary for serious multi-tenant node security; they are not sufficient. This article explains residual…
By mid-2026, cloud-native security conversations keep returning to two stubborn themes: shared-kernel escape risk and the concentration of power in GitOps and secret operators. This article stays high-level and practical. Where public reporting is noisy or…
With pod user namespaces at GA in Kubernetes v1.36, the question shifts from "is it real?" to "how do we adopt without breaking fleets?" This post outlines a post-GA adoption plan: compatibility testing, Pod Security alignment,…
Kubernetes v1.36 graduates fine-grained kubelet API authorization to GA. That matters because many monitoring agents historically needed the blunt nodes/proxy permission—the same broad key that covers powerful endpoints—to read comparatively innocent surfaces like pod lists or…
Kubernetes v1.36 graduates pod user namespaces to General Availability. For workload owners and platform teams, that is a concrete isolation upgrade: with hostUsers: false, a container's root can map to an unprivileged user on the node,…