This week on the Learn Kubernetes Weekly:
🔥 Informers Are Easy to Misuse
🎤 Three Optimization Lessons
🛑 Graceful Shutdown
🚪 Namespaces & Multi-tenancy
🎯 Centralizing Helm with HTTPProxy
⭐️ StormForge by CloudBolt
Read it now: https://kube.today/issues/161
🔥 Informers Are Easy to Misuse
🎤 Three Optimization Lessons
🛑 Graceful Shutdown
🚪 Namespaces & Multi-tenancy
🎯 Centralizing Helm with HTTPProxy
⭐️ StormForge by CloudBolt
Read it now: https://kube.today/issues/161
December 10, 2025 at 11:51 AM
This week on the Learn Kubernetes Weekly:
🔥 Informers Are Easy to Misuse
🎤 Three Optimization Lessons
🛑 Graceful Shutdown
🚪 Namespaces & Multi-tenancy
🎯 Centralizing Helm with HTTPProxy
⭐️ StormForge by CloudBolt
Read it now: https://kube.today/issues/161
🔥 Informers Are Easy to Misuse
🎤 Three Optimization Lessons
🛑 Graceful Shutdown
🚪 Namespaces & Multi-tenancy
🎯 Centralizing Helm with HTTPProxy
⭐️ StormForge by CloudBolt
Read it now: https://kube.today/issues/161
Tonight's "vibe coding" session with Gemini CLI.
Issue #40: Can support custom httpproxy?
In Gemini SDK for .NET, let's see how this works out while watching the #MadeByGoogle replay.
Issue #40: Can support custom httpproxy?
In Gemini SDK for .NET, let's see how this works out while watching the #MadeByGoogle replay.
August 20, 2025 at 7:44 PM
Tonight's "vibe coding" session with Gemini CLI.
Issue #40: Can support custom httpproxy?
In Gemini SDK for .NET, let's see how this works out while watching the #MadeByGoogle replay.
Issue #40: Can support custom httpproxy?
In Gemini SDK for .NET, let's see how this works out while watching the #MadeByGoogle replay.
How does Zalando runs their #oss #httpproxy Skipper #kubernetes #ingress stack with #openpolicyagent
engineering.zalando.com/posts/2024/1...
engineering.zalando.com/posts/2024/1...
Zalando Engineering Blog - Open Policy Agent in Skipper Ingress
Zalando has integrated Open Policy Agent (OPA) into Skipper, our open-source Ingress controller, to provide Authorization as a Service. It aims to simplify the developer experience and provides...
engineering.zalando.com
December 6, 2024 at 6:50 PM
How does Zalando runs their #oss #httpproxy Skipper #kubernetes #ingress stack with #openpolicyagent
engineering.zalando.com/posts/2024/1...
engineering.zalando.com/posts/2024/1...
HTTPProxy は固有の public IP を持ってなくて、Envoy とか nginx の IP を BGP 等で広報してその IP アドレスを DNS の公開権威サーバーに登録して通信を引き込みます。Envoy/nginx は受け取った HTTP リクエストの宛先ドメインを読み取って HTTPProxy で指定された backend pod のどれか一つに通信を転送します
December 9, 2024 at 12:28 PM
HTTPProxy は固有の public IP を持ってなくて、Envoy とか nginx の IP を BGP 等で広報してその IP アドレスを DNS の公開権威サーバーに登録して通信を引き込みます。Envoy/nginx は受け取った HTTP リクエストの宛先ドメインを読み取って HTTPProxy で指定された backend pod のどれか一つに通信を転送します
This case-study explains how a team replaced multiple Ingress resources under shared domains with a single HTTPProxy to avoid resource conflicts, simplify routing, and enforce unified TLS/timeout policies when centralizing Helm charts
➜ https://ku.bz/D-bzMF9lM
➜ https://ku.bz/D-bzMF9lM
December 8, 2025 at 3:06 PM
This case-study explains how a team replaced multiple Ingress resources under shared domains with a single HTTPProxy to avoid resource conflicts, simplify routing, and enforce unified TLS/timeout policies when centralizing Helm charts
➜ https://ku.bz/D-bzMF9lM
➜ https://ku.bz/D-bzMF9lM
📌 CVE-2026-41246 - Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature... https://www.cyberhub.blog/cves/CVE-2026-41246
CVE-2026-41246
Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in spec.ro
www.cyberhub.blog
July 23, 2026 at 4:07 PM
📌 CVE-2026-41246 - Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature... https://www.cyberhub.blog/cves/CVE-2026-41246
You can now share your thoughts on vulnerability CVE-2025-22870 in Vulnerability-Lookup:
https://vulnerability.circl.lu/vuln/CVE-2025-22870
golang.org/x/net - golang.org/x/net/http/httpproxy
#vulnerabilitylookup #vulnerability #cybersecurity #bot
https://vulnerability.circl.lu/vuln/CVE-2025-22870
golang.org/x/net - golang.org/x/net/http/httpproxy
#vulnerabilitylookup #vulnerability #cybersecurity #bot
cvelistv5 - CVE-2025-22870
Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.
vulnerability.circl.lu
March 12, 2025 at 6:56 PM
You can now share your thoughts on vulnerability CVE-2025-22870 in Vulnerability-Lookup:
https://vulnerability.circl.lu/vuln/CVE-2025-22870
golang.org/x/net - golang.org/x/net/http/httpproxy
#vulnerabilitylookup #vulnerability #cybersecurity #bot
https://vulnerability.circl.lu/vuln/CVE-2025-22870
golang.org/x/net - golang.org/x/net/http/httpproxy
#vulnerabilitylookup #vulnerability #cybersecurity #bot
This case-study explains how a team replaced multiple Ingress resources under shared domains with a single HTTPProxy to avoid resource conflicts, simplify routing, and enforce unified TLS/timeout policies when centralizing Helm charts
➤ https://ku.bz/D-bzMF9lM
➤ https://ku.bz/D-bzMF9lM
January 8, 2026 at 3:06 PM
This case-study explains how a team replaced multiple Ingress resources under shared domains with a single HTTPProxy to avoid resource conflicts, simplify routing, and enforce unified TLS/timeout policies when centralizing Helm charts
➤ https://ku.bz/D-bzMF9lM
➤ https://ku.bz/D-bzMF9lM
証明書はワイルドカードで1つだけ取って、クラスタ内のサービス公開時はContourのHTTPProxyリソースで設定。
↑でトラフィックを受け取るEnvoyのServiceリソースをtailscale operatorの機能でtailnetに公開。
tailscaleに自分のNextDNSを設定して、NextDNSの機能で特定サブドメインの応答をtailnet上のdeviceへ上書き。
これでパブリックDNSに名前を公開せず、VPN内だけで独自ドメイン解決してHTTPSなサービスを公開できる。
↑でトラフィックを受け取るEnvoyのServiceリソースをtailscale operatorの機能でtailnetに公開。
tailscaleに自分のNextDNSを設定して、NextDNSの機能で特定サブドメインの応答をtailnet上のdeviceへ上書き。
これでパブリックDNSに名前を公開せず、VPN内だけで独自ドメイン解決してHTTPSなサービスを公開できる。
February 2, 2025 at 3:27 AM
証明書はワイルドカードで1つだけ取って、クラスタ内のサービス公開時はContourのHTTPProxyリソースで設定。
↑でトラフィックを受け取るEnvoyのServiceリソースをtailscale operatorの機能でtailnetに公開。
tailscaleに自分のNextDNSを設定して、NextDNSの機能で特定サブドメインの応答をtailnet上のdeviceへ上書き。
これでパブリックDNSに名前を公開せず、VPN内だけで独自ドメイン解決してHTTPSなサービスを公開できる。
↑でトラフィックを受け取るEnvoyのServiceリソースをtailscale operatorの機能でtailnetに公開。
tailscaleに自分のNextDNSを設定して、NextDNSの機能で特定サブドメインの応答をtailnet上のdeviceへ上書き。
これでパブリックDNSに名前を公開せず、VPN内だけで独自ドメイン解決してHTTPSなサービスを公開できる。
Sensitive headers not cleared on cross-origin redirect in net/httpProxy-Autho... Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive...
Origin | Interest | Match
Origin | Interest | Match
CVE-2025-4673 | THREATINT
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
cve.threatint.eu
June 11, 2025 at 5:37 PM
httpProxy configured. Example: guardrails: envVars: NO_PROXY: 'kubernetes.default.svc,172.20.0.1'
May 21, 2026 at 4:20 AM
httpProxy configured. Example: guardrails: envVars: NO_PROXY: 'kubernetes.default.svc,172.20.0.1'
Once you've setup contour-authserver, you simply add the following authorization snippet to your HTTPProxy deployment manifest
The cool thing about authserver is it uses htpasswd implementation, meaning you can add multiple users where as our implementation, it was single user
The cool thing about authserver is it uses htpasswd implementation, meaning you can add multiple users where as our implementation, it was single user
July 15, 2023 at 12:32 AM
Once you've setup contour-authserver, you simply add the following authorization snippet to your HTTPProxy deployment manifest
The cool thing about authserver is it uses htpasswd implementation, meaning you can add multiple users where as our implementation, it was single user
The cool thing about authserver is it uses htpasswd implementation, meaning you can add multiple users where as our implementation, it was single user
もしかして HTTPProxy と HTTP_PROXY 両方ある。ややこしすぎない…
December 9, 2024 at 12:38 PM
もしかして HTTPProxy と HTTP_PROXY 両方ある。ややこしすぎない…
#Pgbackrest does not support HTTP proxies (in its #s3 client). This was raised on Github couple of times.
Suggested workaround is to use #proxychains.
Discovering you need to slap some extra component into a critical path of a critical workflow is exciting...
#postgresql #backup #httpproxy
1/
Suggested workaround is to use #proxychains.
Discovering you need to slap some extra component into a critical path of a critical workflow is exciting...
#postgresql #backup #httpproxy
1/
May 12, 2025 at 11:36 AM
#Pgbackrest does not support HTTP proxies (in its #s3 client). This was raised on Github couple of times.
Suggested workaround is to use #proxychains.
Discovering you need to slap some extra component into a critical path of a critical workflow is exciting...
#postgresql #backup #httpproxy
1/
Suggested workaround is to use #proxychains.
Discovering you need to slap some extra component into a critical path of a critical workflow is exciting...
#postgresql #backup #httpproxy
1/