[{"data":1,"prerenderedAt":34},["ShallowReactive",2],{"blog-tag-en-rbac":3},[4,15,24],{"path":5,"title":6,"description":7,"date":8,"tags":9},"\u002Fblog\u002Fen\u002Fk3s-mcp-ai-agent-rbac-permission-bypass","We Asked an AI Agent to 'Check a Pod,' and It Took Over the Entire K3s Cluster: What an MCP Server's Permission Bypass Teaches Us About RBAC Design","A real-world MCP permission bypass shows why Kubernetes\u002FK3s clusters need disciplined RBAC design and audit-log separation before letting AI agents operate them.","2026-09-03",[10,11,12,13,14],"k3s","kubernetes","mcp","rbac","ai-agent",{"path":16,"title":17,"description":18,"date":19,"tags":20},"\u002Fblog\u002Fen\u002Fkubernetes-secrets-rbac-etcd-encryption","Base64 Isn't Encryption: Why Kubernetes Secrets Pass Right Through, and the RBAC Design Traps That Make It Worse","Kubernetes Secrets are only Base64-encoded, not encrypted. Learn how plaintext-equivalent storage in etcd and over-permissioned RBAC lead to real incidents, plus the concrete Secrets management practices you need for production K3s.","2026-07-29",[11,10,21,13,22,23],"secrets-management","security","etcd-encryption",{"path":25,"title":26,"description":27,"date":28,"tags":29},"\u002Fblog\u002Fen\u002Fcontainer-registry-harbor-setup","Building a Private Container Registry with Harbor","Complete guide to deploying and operating Harbor as your private container registry. Covers Trivy integration, RBAC, image replication, Helm deployment, and enterprise security features.","2026-05-27",[30,31,32,11,22,33,13],"harbor","container-registry","docker","trivy",1792488954915]