Image Scanning + Admission Control: Stop Vulnerable Images
How to scan container images with Trivy or Grype and enforce results with Kyverno or Gatekeeper admission policies, plus an exception workflow that won't get abused.
Read the postPosts tagged "security"
8 posts about security in the conndeck blog — field notes on local-first Kubernetes operations, GitOps, and production debugging.
Kubernetes Audit Logs: Finding the Needle Before the Incident
How to tune Kubernetes audit policy, what to actually alert on, and how to keep log volume from eating your budget. Practical audit logging for platform teams.
Read the postPod Security Standards: Getting to restricted Without a Revolt
A field-tested rollout plan for Pod Security Standards: audit mode first, baseline before restricted, and exemptions that don't become permanent.
Read the postRBAC Least Privilege: Designing Roles People Can Live With
Practical Kubernetes RBAC design: namespaced Roles over ClusterRoles, aggregated clusterroles for teams, killing wildcard verbs, and audits people actually run.
Read the postService Account Tokens: The Quiet Security Hole in Every Cluster
Service account tokens are mounted into every pod by default. Here's how automountServiceAccountToken, bound tokens, and workload identity close the hole.
Read the postSupply Chain Security: Sigstore, SLSA, and What's Actually Practical
A pragmatic take on supply chain security: cosign keyless signing, signature verification at admission, SBOMs that get used, and SLSA without ceremony.
Read the postExternal Secrets Operator: Stop Committing Secrets
Why encrypted secrets in git still lose, and how to wire External Secrets Operator to Vault or a cloud secret manager with rotation that actually works.
Read the postForbidden: Debugging RBAC Without Handing Out cluster-admin
RBAC Forbidden errors decode completely if you read them. Use kubectl auth can-i, impersonation, and bindings to grant exactly what's missing.
Read the post