Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Kubernetes”
37 publicationsWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskChoosing isolation for a Kubernetes tenant
A namespace, a virtual control plane and a sandboxed runtime protect different boundaries. Start with tenant authority before choosing the cluster architecture.
Workload security · Kubernetes / gVisor / Kata Containers · By Cloud Security DeskMake secret rotation reach every running application
Secret managers, mounted files, application memory and connection pools can disagree about the active credential. Test each stage before calling rotation complete.
Workload security · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskDesign an outbound fetch service that contains SSRF
A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.
Workload security · OWASP / IANA · By Cloud Security DeskA budget model for bounded AI inference
Request throttles, token quotas and billing alerts control different things. An inference service needs an admission decision that reserves bounded work and reconciles what actually ran.
AI systems · AWS / Kubernetes / vLLM · By Cloud Security DeskThe telemetry collector is part of the evidence boundary
Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.
Detection & response · OpenTelemetry · By Cloud Security DeskKnow when AWS KMS encryption needs an envelope
KMS Encrypt has small plaintext limits. Follow the data key and encrypted-message format when an application needs to protect larger payloads.
Workload security · AWS · By Cloud Security DeskKeep database changes compatible with application rollback
Preserve an explicit relationship between old code and migrated state through additive changes, safe backfills, and a defined rollback window.
Resilience · Kubernetes / GitLab · By Cloud Security DeskVerify container provenance before admitting a pinned image
Use the digest to identify the artifact, then check who signed it, which builder produced it, and which evidence survived promotion into the deployment registry.
Workload security · Kubernetes / Docker / Sigstore · By Cloud Security DeskMeasure recovery by the service you can restore
Define application acceptance, recoverable data, and a complete timeline before treating a completed restore job as proof of recovery.
Resilience · AWS / PostgreSQL · By Cloud Security DeskTest Kubernetes egress policies beyond a successful DNS lookup
Separate DNS resolution, source egress, destination ingress, and application identity when testing Kubernetes network isolation.
Workload security · Kubernetes / Cilium · By Cloud Security DeskRoll out Kubernetes Pod Security Admission without surprises
Stage namespace enforcement around the Pods a controller will create next, with explicit policy versions, runtime checks, and narrowly owned exceptions.
Workload security · Kubernetes · By Cloud Security DeskFive Kubernetes events your cloud trail will not explain
Cloud control-plane logs tell you who changed the cluster. They do not fully explain what happened inside it.
Detection & response · Workload security · Kubernetes · By Umair Akbar and Ahmed Elshekh