[{"data":1,"prerenderedAt":136},["ShallowReactive",2],{"blog-tag-en-security":3},[4,15,23,31,39,48,57,66,76,84,94,103,111,121,129],{"path":5,"title":6,"description":7,"date":8,"tags":9},"\u002Fblog\u002Fen\u002Fk3s-zero-trust-kubectl-management-access","Stop Trusting Your Corporate VPN: 3 Steps to Make K3s Management Access Boundary-Free","Are you still designing K3s cluster management access around a corporate VPN? Learn 3 practical steps to secure kubectl and Rancher dashboard access with identity instead of network perimeter, plus the pitfall most teams hit when they implement zero trust.","2026-09-05",[10,11,12,13,14],"k3s","kubernetes","zero-trust","security","rancher",{"path":16,"title":17,"description":18,"date":19,"tags":20},"\u002Fblog\u002Fen\u002Fkubernetes-certificate-management-cert-manager-process-debt","The Cert Renewal Took One Line of Code and Two Months of Meetings: Why Kubernetes Certificate Management Is a Process Problem, Not a Technical One","Kubernetes certificate management is technically a matter of days. What actually takes time is the organizational process of getting sign-off. Here's how cert-manager automates the technical side, and how to design away the operational debt that remains.","2026-08-09",[10,11,21,22,13],"cert-manager","tls",{"path":24,"title":25,"description":26,"date":27,"tags":28},"\u002Fblog\u002Fen\u002Fai-agent-sandbox-kata-containers-kubernetes","AI Agent Code Isn't a \"Trusted Product\" Anymore. Kubernetes Sandbox Design Has an Answer","Code generated and executed by AI agents can no longer be treated as a trusted, reviewed product. This article explains the limits of container isolation and why Kata Containers' microVM isolation is becoming essential when designing AI agent sandboxes on Kubernetes.","2026-08-08",[10,11,29,30,13],"kata-containers","ai-agent",{"path":32,"title":33,"description":34,"date":35,"tags":36},"\u002Fblog\u002Fen\u002Fkubernetes-image-signing-sigstore-supply-chain","Anyone Can Rewrite an Image Tag. Why Kubernetes Needs Sigstore-Backed Signing to Prove Provenance","Container image signing explained: tags can be overwritten by anyone, and passing CI tests doesn't guarantee the image running in production is the one you built. Learn how Sigstore and Kyverno work together to reject unsigned images on Kubernetes\u002FK3s, integrated into a GitOps workflow.","2026-08-06",[10,11,37,38,13],"ci-cd","gitops",{"path":40,"title":41,"description":42,"date":43,"tags":44},"\u002Fblog\u002Fen\u002Fkubernetes-secrets-rbac-etcd-encryption","Base64 Isn't Encryption: Why Kubernetes Secrets Pass Right Through, and the RBAC Design Traps That Make It Worse","Kubernetes Secrets are only Base64-encoded, not encrypted. Learn how plaintext-equivalent storage in etcd and over-permissioned RBAC lead to real incidents, plus the concrete Secrets management practices you need for production K3s.","2026-07-29",[11,10,45,46,13,47],"secrets-management","rbac","etcd-encryption",{"path":49,"title":50,"description":51,"date":52,"tags":53},"\u002Fblog\u002Fen\u002Fshadow-ai-kubernetes-admission-control-governance","Rogue Deployments Are Wrecking Your Company: The Shadow AI Problem Inside Kubernetes Clusters, and Admission Control as the Fix","Shadow AI isn't just unauthorized SaaS tools. It's happening inside your Kubernetes clusters too. Here's the risk it creates, and how Admission Control turns detection into real governance.","2026-07-17",[11,10,54,55,56,13],"shadow-ai","admission-control","kyverno",{"path":58,"title":59,"description":60,"date":61,"tags":62},"\u002Fblog\u002Fen\u002Fkubernetes-v136-k3s-managed-cost-reduction","Managed Kubernetes is Too Expensive. The Reality of 'Full K8s Operations Under $400\u002FMonth' with K3s Lightweight and v1.36 Security Enhancements","Explore how to leverage Kubernetes v1.36 'Haru' enhanced User Namespaces and security features in K3s lightweight environments. Discover managed K3s operational strategies and 2026 infrastructure selection guidelines that achieve 60% cost reduction compared to EKS.","2026-05-28",[10,11,63,64,65,13],"kubernetes-v136","managed-kubernetes","cost-optimization",{"path":67,"title":68,"description":69,"date":70,"tags":71},"\u002Fblog\u002Fen\u002Fcert-manager-automatic-tls","Automating TLS Certificate Management in Kubernetes with cert-manager","Automate TLS certificate issuance and renewal in Kubernetes using cert-manager. Covers Let's Encrypt, ACME challenges, Ingress integration, and best practices.","2026-05-27",[21,11,22,72,73,74,13,75],"lets-encrypt","acme","cncf","certificates",{"path":77,"title":78,"description":79,"date":70,"tags":80},"\u002Fblog\u002Fen\u002Fcicd-pipeline-security-devsecops","ci-cd Pipeline Security: A Practical DevSecOps Guide","A practical guide to ci-cd pipeline security from a DevSecOps perspective. Covers SAST\u002FDAST, supply chain protection, the SLSA framework, and Policy as Code.",[81,37,13,82,83,11],"devsecops","supply-chain","slsa",{"path":85,"title":86,"description":87,"date":70,"tags":88},"\u002Fblog\u002Fen\u002Fcilium-ebpf-kubernetes-networking","Revolutionizing Kubernetes Networking with Cilium and eBPF","Discover how Cilium uses eBPF to transform Kubernetes networking. Compare with traditional CNIs, explore L7 policies, and leverage Hubble for observability.",[89,90,11,91,92,74,13,93],"cilium","ebpf","networking","cni","hubble",{"path":95,"title":96,"description":97,"date":70,"tags":98},"\u002Fblog\u002Fen\u002Fcontainer-registry-harbor-setup","Building a Private Container Registry with Harbor","Complete guide to deploying and operating Harbor as your private container registry. Covers Trivy integration, RBAC, image replication, Helm deployment, and enterprise security features.",[99,100,101,11,13,102,46],"harbor","container-registry","docker","trivy",{"path":104,"title":105,"description":106,"date":70,"tags":107},"\u002Fblog\u002Fen\u002Fdocker-security-scanning-best-practices","Docker Container Security: Scanning and Vulnerability Management","A practical guide to integrating vulnerability scanning into your container ci-cd pipeline. Compare Trivy, Snyk, and Grype, implement shift-left security, and build defense-in-depth with Harbor.",[101,13,108,102,109,110,81],"vulnerability-scanning","snyk","container-security",{"path":112,"title":113,"description":114,"date":70,"tags":115},"\u002Fblog\u002Fen\u002Fdockerfile-best-practices-2025","Dockerfile Best Practices 2025: Building Lightweight, Secure, and Fast Images","Comprehensive 2025 Dockerfile best practices guide covering minimal base images, layer optimization, security hardening, BuildKit features, and production-ready container image construction.",[116,101,117,118,13,119,120],"dockerfile","best-practices","containers","buildkit","optimization",{"path":122,"title":123,"description":124,"date":70,"tags":125},"\u002Fblog\u002Fen\u002Fk3s-production-best-practices","The Complete Guide to K3s Production Best Practices","Learn how to run K3s in production with confidence. Covers HA architecture, security hardening, monitoring, backup strategies, and resource management.",[10,11,126,127,13,128,117],"production","high-availability","operations",{"path":130,"title":131,"description":132,"date":70,"tags":133},"\u002Fblog\u002Fen\u002Fkubernetes-network-policies-security","Zero Trust Security with Kubernetes Network Policies: A Practical Guide","Implement zero trust networking in Kubernetes with Network Policies. From Default Deny to Cilium and Calico advanced policies with real YAML examples.",[11,134,12,13,89,135,91],"network-policy","calico",1792488946333]