Search posts
Latest Recipes
Can You Tell Me Who Ran kubectl exec in Your Production Cluster Last Night?
Something happened in your cluster last Thursday at 2:17am. A pod was deleted. A secret was read. Someone exec'd into a production co...
π Read more
Every Pod in Your Cluster Can Talk to Every Other Pod. By Default. Right Now.
By default, every pod in your Kubernetes cluster can talk to every other pod. No questions asked. No restrictions. Complete internal netw...
π Read more
Supply Chain Attacks on Container Images — Real Examples, Real Fixes
In 2020, attackers modified a legitimate build of SolarWinds Orion during the software build process. The malicious version was signed w...
π Read more
Your Database Password Is in a Kubernetes Secret. Here's Why That's a Problem.
Let me save you from a very embarrassing conversation with your security team. Kubernetes Secrets are not secret. Not by default. Not ...
π Read more
Pod Security Standards: The PSP Replacement You Still Haven't Set Up
PodSecurityPolicies were removed in Kubernetes 1.25. That was quite a while ago. And yet, right now, there are production clusters runnin...
π Read more
Run This kubectl Command. Whatever Comes Back Will Probably Surprise You.
Here's a fun game. Run this in your cluster and read what comes back: kubectl get clusterrolebindings -o json | \ jq '.items[...
π Read more
Your Kubernetes Cluster Has 6 of These 10 Problems Right Now. Let's Fix Them.
The OWASP Kubernetes Top 10 was published. Security teams nodded. Engineers bookmarked it. And then approximately nothing changed in most...
π Read more
Building Your Own Kitchen vs Renting One Per Dish — The Real EKS Decision
Every few months someone asks me this question. Usually right after they've just picked one without fully understanding the other. ...
π Read more
Karpenter Consolidation: The Setting That Saves Money Without Breaking Pods
Let me paint you a picture. It's 11pm on a Tuesday. Traffic died down hours ago. Your Karpenter cluster is sitting on 14 half-empt...
π Read more
I Changed Two Lines of YAML and Cut Our AWS Bill by 40%.
Karpenter cost saving, EKS bill reduction, consolidationPolicy fix, CloudChef case study, AWS cost optimization No clickbait here....
π Read more
Nobody Explains Karpenter NodePools Properly. So We Explained It Twice.
Karpenter NodePool, AWS node selection, disruption policy, Karpenter recipe, CloudChef Kubernetes guide NodePool is the single most...
π Read more