Tag: #security
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 141 posts
ingress-nginx Security Hardening — WAF, mTLS, Blocking Annotation Risks
A security hardening guide for ingress-nginx: disabling snippet annotations and RBAC, ModSecurity/Coraza WAF integration, client-certificate mTLS, external auth, TLS policy, rate limiting, CVE response, multi-tenant isol
2026-06-14 · 11 min read #ingress#kubernetes#nginx#security#devopsIngress WAF - Applying ModSecurity/Coraza and the OWASP CRS
A practical guide to applying a WAF at the Kubernetes Ingress layer. It covers the difference between legacy ModSecurity and its successor engine Coraza, ingress-nginx integration, OWASP CRS tuning and false-positive man
2026-06-14 · 18 min read #ingress#waf#modsecurity#security#kubernetesAutomating Ingress TLS — Fully Automated Certificates with cert-manager and ACME
A hands-on guide to fully automating TLS certificates for Kubernetes Ingress using cert-manager and Let’s Encrypt ACME. Covers the Issuer/Certificate CRD model, HTTP-01 versus DNS-01 challenges, wildcard certificates, re
2026-06-14 · 17 min read #ingress#kubernetes#cert-manager#tls#acmeeBPF Runtime Security — Tetragon, Falco, and BPF LSM
Why runtime security is essential in the era of supply chain attacks and container escapes, and how eBPF answers the call. Covers Falco rule writing, kernel-level blocking with Tetragon TracingPolicy, the principles of B
2026-06-13 · 15 min read #ebpf#security#falco#tetragon#kubernetesFinancial-Grade Kubernetes Platforms — Making Regulation and Cloud Native Coexist
How to design and operate a Kubernetes platform under financial regulations such as network segregation and electronic finance supervision rules. Covers multi-tenancy isolation criteria, Kyverno policy gates, audit trail
2026-06-13 · 20 min read #kubernetes#finance#security#compliance#multi-tenancyIstio Security in Practice — mTLS, AuthorizationPolicy, and the Zero Trust Mesh
From the mesh security model built on SPIFFE identities and the istiod CA, through the PERMISSIVE-to-STRICT migration strategy for PeerAuthentication, least-privilege AuthorizationPolicy design, JWT end-user authenticati
2026-06-13 · 21 min read #istio#mtls#security#authorizationpolicy#zero-trustCilium Network Policy in Practice — Zero Trust from L3 to L7 and DNS
A hands-on guide to going beyond the limits of Kubernetes NetworkPolicy with CiliumNetworkPolicy, controlling L3/L4/L7 and DNS-based egress. Covers a four-stage default-deny rollout roadmap, a Hubble-driven policy author
2026-06-13 · 14 min read #cilium#network-policy#zero-trust#kubernetes#securityThe Age of Mandatory Age Verification — Is Privacy-Preserving Identity Possible?
Examining the push toward mandatory age verification on social media and the privacy concerns it raises, this post walks through privacy-preserving authentication technologies from a developer perspective: zero-knowledge
2026-06-12 · 14 min read #privacy#identity#zero-knowledge#verifiable-credentials#securityThe Degoogle Experiment — A 2026 Guide to Switching Your Privacy Stack
The viral Gmail exit essay and the surge in DuckDuckGo no-AI search traffic point to big tech fatigue. This guide compares alternatives for search, mail, browsers, photos, and drive, plus self-hosting options, a step-by-
2026-06-12 · 21 min read #privacy#degoogle#email#self-hosting#duckduckgoFrom SiteMinder to Keycloak — A Legacy SSO Migration Strategy and Practical Roadmap
A practical roadmap for migrating a SiteMinder estate to Keycloak: application inventory classification, an object mapping table, SAML brokering coexistence architecture, oauth2-proxy header translation, gradual password
2026-06-12 · 16 min read #keycloak#siteminder#sso#iam#migrationSCIM 2.0 Deep Dive — The Standard for Automated User Provisioning
SSO alone cannot manage the account lifecycle. This post takes a practitioner-level deep dive into SCIM 2.0: the spec structure (RFC 7642/7643/7644), User/Group schemas, REST endpoints and PATCH semantics, support in Okt
2026-06-12 · 18 min read #scim#iam#provisioning#sso#securityThe Evolution of Authorization Models — RBAC, ABAC, ReBAC, and OpenFGA/Zanzibar
Once authentication is solved, the next battleground is authorization. We trace the evolution of authorization models from RBAC role explosion through ABAC policy complexity to the ReBAC paradigm introduced by Google Zan
2026-06-12 · 15 min read #authorization#rbac#rebac#openfga#zanzibarOpenID Connect Deep Dive — From the Authorization Code Flow to Discovery
A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea
2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#securityAnatomy of npm Supply Chain Attacks — Defense Strategies for the Era When Even Red Hat Got Hit
Triggered by the June 2026 incident in which even official Red Hat Cloud Services npm packages were exposed to malicious code, this post dissects the types of npm supply chain attacks and lays out the defense stack organ
2026-06-12 · 17 min read #npm#supply-chain#security#devops#sigstoreCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak Observability — Metrics, Audit Logs, and Event-Driven Monitoring
A comprehensive guide to Keycloak observability: the event system and metrics endpoint, shipping events externally with the EventListener SPI, building Prometheus and Grafana dashboards, OpenTelemetry tracing, anomaly de
2026-06-12 · 13 min read #keycloak#observability#monitoring#prometheus#securityKeycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime
A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features
2026-06-12 · 16 min read #keycloak#sso#oidc#security#devopsFAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile
A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,
2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#securityZero Trust and Identity-Aware Proxy — Building the BeyondCorp Model Yourself
The perimeter is dead and identity-first security is the new default. This post walks through the core of the Google BeyondCorp papers and builds an Identity-Aware Proxy from scratch with oauth2-proxy and Keycloak. We co
2026-06-12 · 18 min read #zero-trust#iap#beyondcorp#oauth2-proxy#keycloakSPIFFE/SPIRE Workload Identity — Service-to-Service Authentication Without Secrets
SPIFFE/SPIRE is the answer to secret sprawl in the age of non-human identity. We cover SPIFFE IDs and SVIDs, the SPIRE server/agent architecture and attestation, hands-on Kubernetes deployment YAML, and automatic mTLS vi
2026-06-12 · 16 min read #spiffe#spire#mtls#workload-identity#kubernetes