kube-prometheus-stack: Monitoring That Won’t Page You at 3AM
kube-prometheus-stack gets you 90% of the way there and pages you for the wrong 10%. How I tune alerts, add recording rules, and keep cardinality under control.
Read the postAuthor: <span>conndeck team</span>
Supply Chain Security: Sigstore, SLSA, and What’s Actually Practical
A pragmatic take on supply chain security: cosign keyless signing, signature verification at admission, SBOMs that get used, and SLSA without ceremony.
Read the postService Account Tokens: The Quiet Security Hole in Every Cluster
Service account tokens are mounted into every pod by default. Here's how automountServiceAccountToken, bound tokens, and workload identity close the hole.
Read the postRBAC Least Privilege: Designing Roles People Can Live With
Practical Kubernetes RBAC design: namespaced Roles over ClusterRoles, aggregated clusterroles for teams, killing wildcard verbs, and audits people actually run.
Read the postPod Security Standards: Getting to restricted Without a Revolt
A field-tested rollout plan for Pod Security Standards: audit mode first, baseline before restricted, and exemptions that don't become permanent.
Read the postKubernetes Audit Logs: Finding the Needle Before the Incident
How to tune Kubernetes audit policy, what to actually alert on, and how to keep log volume from eating your budget. Practical audit logging for platform teams.
Read the postImage Scanning + Admission Control: Stop Vulnerable Images
How to scan container images with Trivy or Grype and enforce results with Kyverno or Gatekeeper admission policies, plus an exception workflow that won't get abused.
Read the postVelero: Backups That Survive a Real Disaster
Velero backups are easy to set up and easy to set up wrong. Schedules, kopia file-system backups, snapshot pitfalls, and the restore test that matters.
Read the postStatefulSets: When You Actually Need One
StatefulSets give pods stable names, storage, and ordered rollout. When that matters, when a Deployment is fine, and the headless service nobody explains.
Read the postPVC Stuck in Pending: Every Reason and the Fix
A Pending PVC is always one of a few causes: missing provisioner, topology conflicts, WaitForFirstConsumer timing, or quota. Here's how to tell them apart.
Read the post