The DevOpsBeast Blog

Production engineering notes.

Field notes on Kubernetes, GPUs, Linux, and the rest of the production stack, from engineers who run real infrastructure.

RSS·subscribe in your feed reader
All (42)Container Internals (1)Container Security (1)DevOpsBeast (2)GPU (1)GPU Cost Optimization (1)GPU Infrastructure (3)Kubernetes (1)Kubernetes Architecture (1)Kubernetes Debugging (4)Kubernetes Networking (2)Kubernetes Operations (2)Kubernetes Performance (1)Kubernetes Security (2)Linux (2)LLM Infrastructure (7)Networking (2)Observability (1)Security (8)
Kubernetes Security··12 min read

Your NetworkPolicy Controls the Front Door and Leaves the Building Through the Back.

Most Kubernetes NetworkPolicies restrict who can reach a service and stop there: ingress locked, egress wide open. But the blast radius of a compromised pod is almost entirely an egress story: lateral movement, the cloud metadata endpoint, data exfiltration, calling home. Default-deny in both directions, the DNS gotcha that breaks everything the moment you turn egress on, blocking 169.254.169.254 with an ipBlock except, the CNI that has to actually enforce it, and the audit-then-enforce rollout that doesn't take production down.

Read post
Kubernetes Security··13 min read

A Pod in Your Cluster Just Got Compromised. Walk Me Through the Blast Radius.

One container gets popped: an RCE in an app, a malicious dependency, a leaked token. The junior answer is 'kill the pod.' The senior answer traces the blast radius: from the mounted ServiceAccount token to the API server, across a flat pod network to the cloud metadata endpoint, and through a privileged pod to the node and every secret on it. The attacker's path layer by layer, and the single control that caps the damage at each one: the difference between 'one pod' and 'whole cluster.'

Read post