kubernetes
Safeguard articles tagged "kubernetes" — guides, analysis, and best practices for software supply chain and application security.
100 articles
CVE-2025-55190 in Argo CD: Patch Posture & SBOM Response
Argo CD project details API leaks repository credentials, scored CVSS 9.9. GitOps platforms are now top-tier credential targets. Defender playbook below.
Container Image Security Tools, Compared
A container image security tool scans layers, packages, and configuration inside an image before and after it ships — here's how the major approaches differ and what actually matters when picking one.
Kubernetes Pod Security Context: A Practical Hardening Guide
The Kubernetes pod security context controls the privileges your containers run with. Here is how to configure it, and how it relates to the retired PodSecurityPolicy.
How to Run a Container Security Assessment
A container security assessment reviews your images, registries, orchestration, and runtime against known weaknesses so you can fix them before an attacker finds them.
Kubernetes securityContext, Explained From Scratch
How security context in kubernetes actually works at the pod and container level, what kubernetes runasuser and capability drops do, and a sane default policy to start from.
CVE-2026-42945: A Buffer Overflow in NGINX's Rewrite Module Reaches Into Your Kubernetes Clusters (May 2026)
Disclosed May 17, 2026 with public PoC and in-the-wild activity, CVE-2026-42945 is a buffer overflow in NGINX's ngx_http_rewrite_module. It affects core NGINX and the ingress controllers that wrap it, putting cluster ingress in scope.
Rego Policy Examples: Practical Rules for Policy-as-Code
Real Rego policy examples you can adapt today — from denying privileged containers to gating deployments on vulnerability severity — with the language patterns that make them readable.
k8s securityContext: How to Lock Down Kubernetes Pods and Containers
The k8s securityContext is your first real control over what a container can do at runtime. A field-by-field guide to a hardened, non-root pod spec.
When Configuration Is the Vulnerability: Microsoft's May 2026 Look at Exposed AI Apps on Kubernetes
Microsoft's May 14, 2026 research found AI frameworks shipping Helm charts that expose web UIs on internet-facing LoadBalancers with no authentication and cluster-admin service accounts. Mage AI on port 6789 was the headline, but it was far from alone.
NGINX Ingress TLS: How to Terminate HTTPS Securely on Kubernetes
Configuring NGINX Ingress TLS means wiring up certificates, secrets, and protocol settings so traffic into your cluster is encrypted and hard to downgrade. Here is the secure setup.
Kubernetes Security Issues You Should Actually Worry About
The Kubernetes security issues that cause real breaches are rarely exotic zero-days. They are misconfigured RBAC, exposed dashboards, over-privileged pods, and unscanned images. Here is where to look first.
Trivy Operator v0.30: Kubernetes Field Review
Trivy Operator hit v0.30 in early 2026 and the underlying Trivy v0.70 engine landed in April. We benchmarked the combo on a 60-node multi-tenant cluster.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.