Service Account Tokens: The Quiet Security Hole in Every Cluster
Service account tokens are mounted into every pod by default. Here's how automountServiceAccountToken, bound tokens, and workload identity close the hole.
Read the postconndeck blog
Writing about local-first Kubernetes operations: security posture, fleet drift, GUI plus TUI workflows, and verifiable releases. No telemetry, no login, no data leaves your device.
RBAC Least Privilege: Designing Roles People Can Live With
Practical Kubernetes RBAC design: namespaced Roles over ClusterRoles, aggregated clusterroles for teams, killing wildcard verbs, and audits people actually run.
Read the postPod Security Standards: Getting to restricted Without a Revolt
A field-tested rollout plan for Pod Security Standards: audit mode first, baseline before restricted, and exemptions that don't become permanent.
Read the postKubernetes Audit Logs: Finding the Needle Before the Incident
How to tune Kubernetes audit policy, what to actually alert on, and how to keep log volume from eating your budget. Practical audit logging for platform teams.
Read the postImage Scanning + Admission Control: Stop Vulnerable Images
How to scan container images with Trivy or Grype and enforce results with Kyverno or Gatekeeper admission policies, plus an exception workflow that won't get abused.
Read the postVelero: Backups That Survive a Real Disaster
Velero backups are easy to set up and easy to set up wrong. Schedules, kopia file-system backups, snapshot pitfalls, and the restore test that matters.
Read the postStatefulSets: When You Actually Need One
StatefulSets give pods stable names, storage, and ordered rollout. When that matters, when a Deployment is fine, and the headless service nobody explains.
Read the postPVC Stuck in Pending: Every Reason and the Fix
A Pending PVC is always one of a few causes: missing provisioner, topology conflicts, WaitForFirstConsumer timing, or quota. Here's how to tell them apart.
Read the postRunning Postgres on Kubernetes: Operators Make It Sane
Postgres on Kubernetes doesn't have to be scary. How operators like CloudNativePG handle failover, backups, and upgrades, and why the objections are dated.
Read the postPVs, PVCs, and StorageClasses: The Mental Model That Finally Clicked
PVs, PVCs, and StorageClasses explained the way I wish someone had explained them to me: provisioning, reclaim policies, and expansion, minus the confusion.
Read the postetcd Backup and Restore: The Drill Nobody Practices
Everyone takes etcd snapshots; nobody restores one until it's life or death. Snapshots, quorum loss, and the restore procedure you should drill quarterly.
Read the postBuilding Images Inside Kubernetes: Kaniko vs BuildKit
Kaniko vs BuildKit for in-cluster image builds: why docker:dind is a dead end, how each tool actually works, real caching setups, and which one I'd pick.
Read the post