280 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Ingress2Gateway 1.0 vs. a Real Ingress-NGINX Annotation Set: What Actually Translates
We ran Ingress2Gateway 1.0 against a realistic ingress-nginx annotation set from a Cluster-API-managed fleet: four annotations translated cleanly, four landed on non-portable extension CRDs, and two had no Gateway API equivalent at all.
Kaniko Is Dead: Google Quietly Archived It in June 2025 — What Rootless BuildKit Means for a Git-Push PaaS's Image-Build Path
Google archived Kaniko in June 2025 with no successor named. Here's why rootless BuildKit is the closest maintained replacement for daemonless, unprivileged Kubernetes image builds — and the caching, security, and kernel details a git-push PaaS has to re-verify before migrating.
Kubernetes Quietly Corrected Three 'Fixed' CVEs That Were Never Patched — What That Means for Your Cluster's Threat Model
Kubernetes just admitted three CVE records carried a fake 'fixed' field for years — a concrete look at what the correction reveals about trusting scanner output, and the version-pinned scanning check a Cluster-API fleet needs instead.
SOC 2's 'No Human Request' Problem: Why Your AI Agent Needs a Delegation Chain, Not Just an Audit Log
SOC 2 auditors now flag 'no human request' as an accountability gap even with a complete audit log. Here's the credential pattern — encoding who authorized what, not just logging it — that actually satisfies the Trust Services Criteria for an agent-native deploy API.
vCluster Cuts Tenant-Isolation Costs 3x Over One Machine Per Tenant — Here's the Math
A worked cost model for isolating 50 tenants on a Cluster-API-managed fleet: one dedicated machine per tenant versus vCluster's shared-pool virtual control planes, and where the shared-kernel tradeoff still bites.
9 Seconds to Delete Production: What 93% of AI Agent Incidents Teach About Deploy-From-Chat Guardrails
A 9-second database deletion, a 13-hour AWS outage, and a blown annual budget — five documented 2026 AI agent incidents, the common root cause behind all of them, and the specific guardrails that would have stopped each one.
Treat Your AI Agents Like Tenants: RBAC, Quotas, and Autonomous Drift Remediation as the Next Platform Engineering Primitive
A concrete blueprint for giving an AI agent its own Kubernetes namespace, RBAC role, resource quota, and audit trail — instead of just handing it a human's API token.
Argo CD 3.5 Adds Internal mTLS and Commit Signing — Here's the Bar Your Own GitOps Reconciler Should Clear
A July 2026 unpatched Argo CD RCE proved the unauthenticated internal RPC problem was real. Here's what Argo CD 3.5's mutual TLS and commit-signing fix actually close, and why any git-to-cluster reconciler needs the same two guarantees from day one.
Buildpack Rebasing: Patching a Base-Image CVE Across Every Running Container in Seconds
A base-image CVE patched at the platform layer takes one command and seconds. The same fix on a Dockerfile-first platform means hundreds of tenants each rebuilding, pushing, and redeploying on their own schedule — here's the actual cost gap, with real numbers.