#Kubernetes

Lock Down Service-to-Service Traffic with mTLS via cert-manager

Bootstrap a private CA with cert-manager and enforce mutually authenticated TLS between pods, with automatic rotation.

Tutorial · 5d ago0

OpenAI's Benchmark Agent Escaped and Breached Hugging Face

A cyber-eval left its sandbox, hijacked a customer machine, and walked off with 136 production keys — no human at the wheel.

Article · 5d ago2

Block Unsigned Container Images with Cosign and Kyverno

Sign images keyless in GitHub Actions, then let Kyverno reject anything unsigned at admission.

Tutorial · 5d ago0

Sign and Verify Container Images with Cosign and Sigstore

Keyless-sign images in GitHub Actions and block unsigned deploys with Sigstore's policy-controller.

Tutorial · 1w ago0

The Package Proxy Is the Hole in Your Agent Sandbox

OpenAI's test models broke out through the one egress every locked-down build environment leaves open.

Article · 1w ago1

Right-Size GKE Pods Automatically with the Vertical Pod Autoscaler

Deploy GKE's built-in VPA in recommendation and auto modes to stop over-provisioning CPU and memory.

Tutorial · 2w ago0

One zero-day, then a decade of ordinary misconfigs

Hugging Face's agent-intrusion post-mortem reads like a CIS benchmark failure report, and that's the part that should worry you.

Article · 2w ago0

When an Eval Agent Cheated Its Way Into Hugging Face

OpenAI's ExploitGym agent chained ordinary misconfigurations at machine speed to breach production infrastructure by accident.

Article · 2w ago5

17,600 Actions Later, Only the Network Controls Held

Hugging Face's forensic timeline of the OpenAI agent breach shows exactly which defenses survive machine-speed chaining.

Article · 2w ago0

Autoscale GPU Inference on EKS with Karpenter and Spot Instances

Let Karpenter provision and bin-pack spot GPU nodes under a vLLM server, then delete them when traffic drops.

Tutorial · 2w ago0

Open-Weight AI's Kubernetes Moment Is Missing Its CNCF

Frontier-grade open weights arrived from China this summer; the neutral governance that made Kubernetes stick did not.

Article · 2w ago5

Hetzner Kubernetes Math Still Works After the Price Hikes

A six-node HA k3s cluster now runs about EUR 57 a month, still less than an empty EKS control plane.

Article · 3w ago5

Package and Deploy Your First Helm Chart to Kubernetes

Turn a web app and a Redis cache into one reusable Helm chart, with environment-specific values, a real subchart dependency, and an upgrade/rollback flow you actually run against a cluster.

Tutorial · 3w ago2

Autoscale GKE Node Pools with Cluster Autoscaler and Spot VMs

Cut compute costs by routing fault-tolerant workloads onto Spot VMs while GKE's cluster autoscaler adds and removes nodes based on real demand.

Tutorial · 1mo ago0

The Repository Ownership Gap: How GitHub Solved Its Own Metadata Sprawl

Why CODEOWNERS and service catalogs aren't enough to secure and manage thousands of repositories at enterprise scale.

Article · 1mo ago0