Fortifying the Fort: Defensive Strategies in Kubernetes and Containers
From a pod RCE to production: PSA restricted, RBAC without escalation paths, KMS v2 for Secrets, default-deny NetworkPolicy, IMDS blocking and Falco.
Categories
DevSecOps
6 posts in this category
Practical DevSecOps: Hardening the Supply Chain in the Age of SBOMs
GitHub Actions pipeline: Syft SBOM, Grype gate, keyless signing and attestation with Cosign v3, and admission-time verification with Kyverno.
Hands-On Tutorial: Hardening MLOps – Building a Secure Machine Learning Pipeline with DevSecOps
An ML pipeline with validated, DVC-versioned data, a safetensors model signed with Sigstore, and least-privilege serving on Kubernetes.
Want to Be a DevSecOps Engineer? Then You Need This Tool Stack!
What to run at each pipeline stage (secrets, SAST, SBOM, image, IaC, admission, DAST, runtime), what should block, and a minimal workflow.
Pipeline Hijacking! An Offensive Perspective on CI/CD and the Hunt for Credentials
How attackers steal credentials from a CI/CD runner, and how to shut them out with OIDC, SHA pinning and admission-time verification.
The 7 Critical Mistakes Every DevSecOps Engineer Must Avoid in Their Pipeline
Seven pipeline mistakes and their fixes: Semgrep on the PR, a Snyk gate, CVSS with EPSS and KEV, pinned Actions, gitleaks, OIDC and ZAP in staging.