Kubernetes

Ingress NGINX Retirement: Treating Community Projects As Critical Vendors

in Security architecture

November 15, 2025

Ingress NGINX has been the de-facto front door for a huge number of Kubernetes clusters. It started life as an early, generic implementation of the Ingress API — flexible, cloud-agnostic, and easy to drop into almost any environment. Over time it became the default answer to “how do I get traffic into my cluster?” for on-prem, self-managed and even some managed Kubernetes setups. That is exactly why its retirement matters. The project will continue on best-effort only until March 2026, with no new versions or security fixes afterwards. A core ecosystem component is effectively moving into read-only mode. Users now have to pick a path: adopt a Gateway API-based controller, move to a vendor-backed ingress, or rethink traffic management around managed load balancers. oai_citation:0‡Kubernetes

Continue reading

Distroless Done Right: Curated Minimalism Before Image Minimalism

in Security architecture

November 1, 2025

Distroless is the right destination, but the first move is curated understanding, not a pre-trimmed base. Start by building a system that you can explain: enumerate every component actually used, record why it’s present, and generate an SBOM that reflects your choices—not the entire contents of a generic “slim” image. Only when owners can articulate “what, why, and where” for each package does minimalism become a defendable boundary. Security enables safety when the boundary is intentional, observable, and reversible.

Continue reading

Guarding GenAI Integrity on Kubernetes: Identity Down, Policy Up

in Security architecture

October 26, 2025

AI workloads amplify Kubernetes’ flexibility—and its failure modes. Integrity requires controls that understand models, data paths, and runtime drift, not just pods and namespaces. Push identity down with workload-bound credentials; push policy up with context from model criticality and data sensitivity. Watch the gray zones: GPU device plugins, sidecar sprawl, and egress to model registries. Least privilege, immutable images, and runtime enforcement are table stakes; without AI-aware guardrails, the blast radius grows silently. If latency budgets reject CPU hooks, pivot to eBPF plus network policy—not “trust me” exemptions.

Continue reading

Search

Categories

Tags