Lock down ingress traffic with NetworkPolicies plus an internal-only IngressClass. Pod selector matches ingress controller pods, rules restrict to LB CIDRs. #kubernetes #networkpolicy #ingress https://www.valtersit.com/vault/restrict-ingress-exposure-with-networkpolicy-and-internalonl-582492/
Restrict Ingress Exposure with NetworkPolicy and Internal-Only Class
www.valtersit.com
November 6, 2026 at 7:10 AM
Lock down ingress traffic with NetworkPolicies plus an internal-only IngressClass. Pod selector matches ingress controller pods, rules restrict to LB CIDRs. #kubernetes #networkpolicy #ingress https://www.valtersit.com/vault/restrict-ingress-exposure-with-networkpolicy-and-internalonl-582492/
EKS-এ একই node-এর একটা pod neighbour-এর NetworkPolicy পাশ কাটাতে পারত। Fix: VPC CNI 1.22.3, কোনো workaround নেই।
NetworkPolicy একটা filter, tenant-এর দেয়াল না।
আপনি কি একই node-এ আলাদা tenant চালান?
NetworkPolicy একটা filter, tenant-এর দেয়াল না।
আপনি কি একই node-এ আলাদা tenant চালান?
November 9, 2026 at 7:10 AM
EKS-এ একই node-এর একটা pod neighbour-এর NetworkPolicy পাশ কাটাতে পারত। Fix: VPC CNI 1.22.3, কোনো workaround নেই।
NetworkPolicy একটা filter, tenant-এর দেয়াল না।
আপনি কি একই node-এ আলাদা tenant চালান?
NetworkPolicy একটা filter, tenant-এর দেয়াল না।
আপনি কি একই node-এ আলাদা tenant চালান?
A pod on the same EKS node could sneak past its neighbour's NetworkPolicy. Fixed in VPC CNI 1.22.3, no workaround.
NetworkPolicy is a filter, not a tenant wall.
Do you run different tenants on the same node?
NetworkPolicy is a filter, not a tenant wall.
Do you run different tenants on the same node?
November 9, 2026 at 7:10 AM
A pod on the same EKS node could sneak past its neighbour's NetworkPolicy. Fixed in VPC CNI 1.22.3, no workaround.
NetworkPolicy is a filter, not a tenant wall.
Do you run different tenants on the same node?
NetworkPolicy is a filter, not a tenant wall.
Do you run different tenants on the same node?
Security advisories 10/34
AWS fixes EKS network policy bypass and a Firecracker memory flaw
Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS.
#infosec #cybersecurity
trustlist.uk/security-advisorie…
AWS fixes EKS network policy bypass and a Firecracker memory flaw
Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS.
#infosec #cybersecurity
trustlist.uk/security-advisorie…
AWS fixes EKS network policy bypass and a Firecracker memory flaw
Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS. Bulletin 2026-169 fixes guest access to Firecracker memory in one snapshot…
trustlist.uk
November 6, 2026 at 9:35 AM
Security advisories 10/34
AWS fixes EKS network policy bypass and a Firecracker memory flaw
Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS.
#infosec #cybersecurity
trustlist.uk/security-advisorie…
AWS fixes EKS network policy bypass and a Firecracker memory flaw
Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS.
#infosec #cybersecurity
trustlist.uk/security-advisorie…
This tutorial teaches how to secure Kubernetes AI platforms with RBAC, NetworkPolicy, secrets, resource limits, Kyverno, OPA Gatekeeper, and automatic policy checks
➤ https://ku.bz/1DWwJ78lF
➤ https://ku.bz/1DWwJ78lF
November 7, 2026 at 6:16 PM
This tutorial teaches how to secure Kubernetes AI platforms with RBAC, NetworkPolicy, secrets, resource limits, Kyverno, OPA Gatekeeper, and automatic policy checks
➤ https://ku.bz/1DWwJ78lF
➤ https://ku.bz/1DWwJ78lF
Starting now at Agent Substrate Day in Salt Lake City: Keith Mattix on Network Policy at Substrate Scale.
Substrate is running. Now your actors have to fit your security posture. Keith shows how Substrate's zero trust tools compose with service mesh and Kubernetes NetworkPolicy.
atecon.dev
Substrate is running. Now your actors have to fit your security posture. Keith shows how Substrate's zero trust tools compose with service mesh and Kubernetes NetworkPolicy.
atecon.dev
November 9, 2026 at 6:02 PM
Starting now at Agent Substrate Day in Salt Lake City: Keith Mattix on Network Policy at Substrate Scale.
Substrate is running. Now your actors have to fit your security posture. Keith shows how Substrate's zero trust tools compose with service mesh and Kubernetes NetworkPolicy.
atecon.dev
Substrate is running. Now your actors have to fit your security posture. Keith shows how Substrate's zero trust tools compose with service mesh and Kubernetes NetworkPolicy.
atecon.dev
Before trying gVisor for agent sandboxes on plain k8s: runsc as a containerd shim on each node, exposed via RuntimeClass, systrap platform (ptrace is slow). It isolates syscalls, not credentials: still set automountServiceAccountToken: false plus a deny-all NetworkPolicy.
November 8, 2026 at 10:12 AM
Before trying gVisor for agent sandboxes on plain k8s: runsc as a containerd shim on each node, exposed via RuntimeClass, systrap platform (ptrace is slow). It isolates syscalls, not credentials: still set automountServiceAccountToken: false plus a deny-all NetworkPolicy.
Kubernetes: por qué se pierden archivos y se cae la API
¿Por qué se borran tus archivos al reiniciar un pod? Kubernetes networking y storage: el caso real con 1.240 uploads perdidos y cómo evitarlo
#kubernetes #networkpolicy #persistentvolume #devops #calico
¿Por qué se borran tus archivos al reiniciar un pod? Kubernetes networking y storage: el caso real con 1.240 uploads perdidos y cómo evitarlo
#kubernetes #networkpolicy #persistentvolume #devops #calico
Kubernetes: por qué se pierden archivos y se cae la API
1.240 archivos perdidos y un checkout caído 35 minutos: el caso real que explica networking y storage en Kubernetes, y cómo evitarlo.
donweb.news
November 6, 2026 at 3:43 AM
Kubernetes: por qué se pierden archivos y se cae la API
¿Por qué se borran tus archivos al reiniciar un pod? Kubernetes networking y storage: el caso real con 1.240 uploads perdidos y cómo evitarlo
#kubernetes #networkpolicy #persistentvolume #devops #calico
¿Por qué se borran tus archivos al reiniciar un pod? Kubernetes networking y storage: el caso real con 1.240 uploads perdidos y cómo evitarlo
#kubernetes #networkpolicy #persistentvolume #devops #calico
K3s isn't "Kubernetes with less networking." It just made the CNI choice for you.
Flannel/VXLAN by default; kubeadm ships no CNI. The catch: Flannel doesn't enforce NetworkPolicy, so namespace isolation is often silently off. Pick Calico or Cilium before production.
#K3s #Kubernetes #CNI
Flannel/VXLAN by default; kubeadm ships no CNI. The catch: Flannel doesn't enforce NetworkPolicy, so namespace isolation is often silently off. Pick Calico or Cilium before production.
#K3s #Kubernetes #CNI
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that dif...
kubo.hexabase.io
November 4, 2026 at 6:24 AM
K3s isn't "Kubernetes with less networking." It just made the CNI choice for you.
Flannel/VXLAN by default; kubeadm ships no CNI. The catch: Flannel doesn't enforce NetworkPolicy, so namespace isolation is often silently off. Pick Calico or Cilium before production.
#K3s #Kubernetes #CNI
Flannel/VXLAN by default; kubeadm ships no CNI. The catch: Flannel doesn't enforce NetworkPolicy, so namespace isolation is often silently off. Pick Calico or Cilium before production.
#K3s #Kubernetes #CNI
AWS Patches Critical Amazon EKS Network Policy Agent Bypass Vulnerability + Video
Introduction: Amazon Web Services (AWS) addressed a significant security vulnerability in the Amazon Elastic Kubernetes Service (EKS) Network Policy Agent (aws-1etwork-policy-agent), a critical component of the…
Introduction: Amazon Web Services (AWS) addressed a significant security vulnerability in the Amazon Elastic Kubernetes Service (EKS) Network Policy Agent (aws-1etwork-policy-agent), a critical component of the…
AWS Patches Critical Amazon EKS Network Policy Agent Bypass Vulnerability + Video
Introduction: Amazon Web Services (AWS) addressed a significant security vulnerability in the Amazon Elastic Kubernetes Service (EKS) Network Policy Agent (aws-1etwork-policy-agent), a critical component of the Amazon VPC CNI plugin. The flaw allows authenticated workloads inside a cluster to bypass Kubernetes `NetworkPolicy` ingress controls and break isolation barriers intended to protect adjacent pod workloads. Without timely updates to cluster policy agents, low-privilege pods running on shared nodes could access unauthorized east-west network traffic, compromising multi-tenant security guarantees.
undercodetesting.com
November 6, 2026 at 4:20 PM
AWS Patches Critical Amazon EKS Network Policy Agent Bypass Vulnerability + Video
Introduction: Amazon Web Services (AWS) addressed a significant security vulnerability in the Amazon Elastic Kubernetes Service (EKS) Network Policy Agent (aws-1etwork-policy-agent), a critical component of the…
Introduction: Amazon Web Services (AWS) addressed a significant security vulnerability in the Amazon Elastic Kubernetes Service (EKS) Network Policy Agent (aws-1etwork-policy-agent), a critical component of the…
FQDN Network Policy turns hostnames into current IP addresses and creates standard Kubernetes NetworkPolicy rules, so teams can control outbound traffic on any CNI without replacing their network plugin
➤ https://ku.bz/NprbZjd3s
➤ https://ku.bz/NprbZjd3s
October 30, 2026 at 6:26 PM
FQDN Network Policy turns hostnames into current IP addresses and creates standard Kubernetes NetworkPolicy rules, so teams can control outbound traffic on any CNI without replacing their network plugin
➤ https://ku.bz/NprbZjd3s
➤ https://ku.bz/NprbZjd3s
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.
kubo.hexabase.io
October 30, 2026 at 3:01 PM
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
Pod IP는 믿지 말고 Service 이름을 불러라…ClusterIP·DNS부터 Ingress 이후의 Gateway API까지
https://now.zeta4.net/a/2026-10-30-k8s-hands-on-4-networking
https://now.zeta4.net/a/2026-10-30-k8s-hands-on-4-networking
Pod IP는 믿지 말고 Service 이름을 불러라…ClusterIP·DNS부터 Ingress 이후의 Gateway API까지
「쿠버네티스 손으로 익히기」 4회. 쿠버네티스 네트워크 모델, Service의 종류와 클러스터 DNS, 기능 추가가 멈춘 Ingress와 2026년 3월 지원이 끝난 Ingress NGINX, 그 대안인 Gateway API, 그리고 NetworkPolicy를 정리하고 서비스 두 개를 이름으로 연결하는 실습을 한다.
now.zeta4.net
October 30, 2026 at 1:29 AM
Pod IP는 믿지 말고 Service 이름을 불러라…ClusterIP·DNS부터 Ingress 이후의 Gateway API까지
https://now.zeta4.net/a/2026-10-30-k8s-hands-on-4-networking
https://now.zeta4.net/a/2026-10-30-k8s-hands-on-4-networking
Layer 4: default-deny NetworkPolicy. podSelector {}, policyTypes Ingress + Egress, zero egress rules. No metadata endpoint, no internal services, no DNS.
Resist "just allow kube-dns": a resolver is a data channel. On a CNI that ignores NetworkPolicy it protects nothing.
Resist "just allow kube-dns": a resolver is a data channel. On a CNI that ignores NetworkPolicy it protects nothing.
October 27, 2026 at 6:08 AM
Layer 4: default-deny NetworkPolicy. podSelector {}, policyTypes Ingress + Egress, zero egress rules. No metadata endpoint, no internal services, no DNS.
Resist "just allow kube-dns": a resolver is a data channel. On a CNI that ignores NetworkPolicy it protects nothing.
Resist "just allow kube-dns": a resolver is a data channel. On a CNI that ignores NetworkPolicy it protects nothing.
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
K3s enforces NetworkPolicy by default via its built-in kube-router controller. Yet traffic via LoadBalancer still leaked through — the cause was ServiceLB's implementation combined with a permanent limitation of the NetworkPolicy API. Here's how to detect and fix it.
kubo.hexabase.io
October 26, 2026 at 3:20 PM
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
Default-deny ingress+egress in your cardholder namespace, then whitelist only payment flows. https://www.valtersit.com/vault/kubernetes-networkpolicy-to-isolate-cardholder-namespace-pci-eb926c/
Kubernetes NetworkPolicy to Isolate Cardholder Namespace (PCI DSS 1.2.1)
www.valtersit.com
October 26, 2026 at 2:00 PM
Default-deny ingress+egress in your cardholder namespace, then whitelist only payment flows. https://www.valtersit.com/vault/kubernetes-networkpolicy-to-isolate-cardholder-namespace-pci-eb926c/
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
K3s enforces NetworkPolicy by default via its built-in kube-router controller. Yet traffic via LoadBalancer still leaked through — the cause was ServiceLB's implementation combined with a permanent limitation of the NetworkPolicy API. Here's how to detect and fix it.
kubo.hexabase.io
October 25, 2026 at 3:16 PM
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.
kubo.hexabase.io
October 26, 2026 at 3:21 PM
K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
7/ Two more timeout causes. A default-deny NetworkPolicy in the webhook ns blocks the API server like any client; control-plane traffic has no pod selector, allow it by CIDR. Or the webhook is slow: p99 near timeoutSeconds = intermittent failures that look like flaky network.
October 25, 2026 at 6:10 AM
7/ Two more timeout causes. A default-deny NetworkPolicy in the webhook ns blocks the API server like any client; control-plane traffic has no pod selector, allow it by CIDR. Or the webhook is slow: p99 near timeoutSeconds = intermittent failures that look like flaky network.
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
K3s enforces NetworkPolicy by default via its built-in kube-router controller. Yet traffic via LoadBalancer still leaked through — the cause was ServiceLB's implementation combined with a permanent limitation of the NetworkPolicy API. Here's how to detect and fix it.
kubo.hexabase.io
October 22, 2026 at 3:16 PM
"K3s Ignores NetworkPolicy" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot
#Kubernetes #DevOps #CloudNative
#Kubernetes #DevOps #CloudNative
Internal gRPC service, no NetworkPolicy, no method auth: public for 11 days. STRIDE applied per trust boundary catches this. https://www.valtersit.com/guides/devsecops/threat-modeling-for-microservices-with-stride/
Threat Modeling Microservices: STRIDE in Practice
www.valtersit.com
October 22, 2026 at 4:50 AM
Internal gRPC service, no NetworkPolicy, no method auth: public for 11 days. STRIDE applied per trust boundary catches this. https://www.valtersit.com/guides/devsecops/threat-modeling-for-microservices-with-stride/
RBACとNetworkPolicyの適切な設定が大事
October 20, 2026 at 3:22 AM
RBACとNetworkPolicyの適切な設定が大事
This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs
➜ https://ku.bz/cSTqKycHb
➜ https://ku.bz/cSTqKycHb
October 15, 2026 at 6:41 PM
This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs
➜ https://ku.bz/cSTqKycHb
➜ https://ku.bz/cSTqKycHb
4/ Also behind the timeout: default-deny NetworkPolicy on the webhook namespace (control-plane traffic has no pod selector, allow by CIDR), or a webhook that is just slow.
p99 of apiserver_admission_webhook_admission_duration_seconds near timeoutSeconds = flaky-looking timeouts.
p99 of apiserver_admission_webhook_admission_duration_seconds near timeoutSeconds = flaky-looking timeouts.
October 15, 2026 at 1:16 AM
4/ Also behind the timeout: default-deny NetworkPolicy on the webhook namespace (control-plane traffic has no pod selector, allow by CIDR), or a webhook that is just slow.
p99 of apiserver_admission_webhook_admission_duration_seconds near timeoutSeconds = flaky-looking timeouts.
p99 of apiserver_admission_webhook_admission_duration_seconds near timeoutSeconds = flaky-looking timeouts.