Kubernetes and containers

Place each security control in the pipeline and decide what it blocks

Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.

Testing, Release · Developers, AppSec engineers, Platform engineers and SREs

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Testing, Maintenance, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Verify artifact signatures against an explicit trust policy

Require the expected artifact, signer and release context before allowing a signed package or image to proceed.

Release · Developers, Platform engineers and SREs

Secure the developer workstation: extensions, package managers, secrets and AI agents

Attackers reach the software supply chain through developers' editors, package installs and AI agents. Allow-list extensions, stop install scripts and brand-new versions, keep long-lived secrets off laptops, and lock down repository files that run code when a project opens.

Design, Development, Release · Developers, AppSec engineers, Platform engineers and SREs

Run Kubernetes workloads with only the privileges they need

Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Prove network and admission policies enforce the intended boundary

Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.

Development, Release, Maintenance · Platform engineers and SREs

Authenticate workloads and authorize their service actions

Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.

Release, Maintenance · Platform engineers and SREs

Turn runtime events into a tested investigation and containment path

Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.

Maintenance · Platform engineers and SREs

Detect container and host threats at runtime with eBPF sensors and cloud services

Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.

Maintenance · Platform engineers and SREs

Harden managed Kubernetes on EKS, AKS and GKE

Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.

Development, Release, Maintenance · AppSec engineers, Platform engineers and SREs

Harden container images from Dockerfile to admission

Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Harden the images you ship against CIS, STIG and SCAP benchmarks

Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.

Development, Release, Maintenance, Security program · Developers, AppSec engineers, Platform engineers and SREs

Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)

How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.

Development, Maintenance · Developers, Platform engineers and SREs

Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS

How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.

Design, Development, Maintenance · Developers, Platform engineers and SREs

Sandbox model-generated code and computer-use agents

Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.

Design, Development · Developers, Platform engineers and SREs

Signed artifact provenance lab: Reject a release from the wrong producer

A deployment gate accepts any signed artifact. A valid signature from an unrelated repository can therefore reach production. Repair the trust policy applied to verified evidence.

Privileged container lab: Reject a privileged workload before deployment

A deployment review checks only the first container. A privileged init container slips through. Repair a deliberately small admission predicate and test all container lists.

NetworkPolicy lab: Lock down a shop namespace

One hurried NetworkPolicy lets every pod in every namespace reach the API, and nothing protects the web tier or the database. Rewrite the shop namespace’s policies so only the flows the application needs are allowed.