kubernetes
Safeguard articles tagged "kubernetes" — guides, analysis, and best practices for software supply chain and application security.
144 articles
Kubernetes securityContext, Explained From Scratch
How security context in kubernetes actually works at the pod and container level, what kubernetes runasuser and capability drops do, and a sane default policy to start from.
CVE-2026-42945: A Buffer Overflow in NGINX's Rewrite Module Reaches Into Your Kubernetes Clusters (May 2026)
Disclosed May 17, 2026 with public PoC and in-the-wild activity, CVE-2026-42945 is a buffer overflow in NGINX's ngx_http_rewrite_module. It affects core NGINX and the ingress controllers that wrap it, putting cluster ingress in scope.
Rego Policy Examples: Practical Rules for Policy-as-Code
Real Rego policy examples you can adapt today — from denying privileged containers to gating deployments on vulnerability severity — with the language patterns that make them readable.
k8s securityContext: How to Lock Down Kubernetes Pods and Containers
The k8s securityContext is your first real control over what a container can do at runtime. A field-by-field guide to a hardened, non-root pod spec.
When Configuration Is the Vulnerability: Microsoft's May 2026 Look at Exposed AI Apps on Kubernetes
Microsoft's May 14, 2026 research found AI frameworks shipping Helm charts that expose web UIs on internet-facing LoadBalancers with no authentication and cluster-admin service accounts. Mage AI on port 6789 was the headline, but it was far from alone.
NGINX Ingress TLS: How to Terminate HTTPS Securely on Kubernetes
Configuring NGINX Ingress TLS means wiring up certificates, secrets, and protocol settings so traffic into your cluster is encrypted and hard to downgrade. Here is the secure setup.
Kubernetes Security Issues You Should Actually Worry About
The Kubernetes security issues that cause real breaches are rarely exotic zero-days. They are misconfigured RBAC, exposed dashboards, over-privileged pods, and unscanned images. Here is where to look first.
Trivy Operator v0.30: Kubernetes Field Review
Trivy Operator hit v0.30 in early 2026 and the underlying Trivy v0.70 engine landed in April. We benchmarked the combo on a 60-node multi-tenant cluster.
Flux CD vs Argo CD: Security Comparison for 2026
A security-focused comparison of Flux 2.5 and Argo CD 3.1: trust models, multi-tenancy, secret handling, signature verification, and the operational differences.
Kubernetes 1.33 Security Deep Dive
Kubernetes 1.33 shipped with meaningful security changes: stronger admission controls, expanded structured authorization, and several deprecations that will affect production clusters.
Kubernetes SecurityContext, Field by Field
SecurityContext in Kubernetes is where pod and container hardening actually lives — here's what each field controls and which defaults you should never leave in place.
How Does a Kubernetes Security Breach Happen and How Do You Prevent One?
Most Kubernetes security breaches trace back to exposed dashboards, leaked credentials, and over-permissive RBAC. Here is how the real attacks unfolded and what stops them.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.