Topic
Cilium
EnvSpec Naming Standard Introduces Strict Six-Environment Hierarchy for Zero Trust Infrastructure
Policy & Regulation
WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors
Vulnerabilities & Exploits
5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected
Vulnerabilities & ExploitsBuilding Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager
The article explains how to establish verifiable TLS across a Kubernetes cluster running on Talos with Cilium networking and Linstor storage, eliminating reliance on InsecureSkipVerify flags. It details the creation of an internal self-signed CA via cert-manager, using a selfSigned bootstrap issuer to generate the CA certificate before deploying a production ClusterIssuer. trust-manager then distributes only the public CA bundle as ConfigMaps across all namespaces, allowing workloads to validate certificates without exposing private keys. For external services, an ACME issuer integrates with Let's Encrypt and Gateway API to automate HTTP-01 challenges. The guide also covers kubelet server certificate rotation through serverTLSBootstrap and the kubelet-serving-cert-approver controller, which validates CSR requests against Node objects before approval. These steps ensure mutual trust for internal services, publicly trusted certificates for internet-facing endpoints, and verified kubelet connections for the API server and monitoring systems.
Securing CI/CD in Open Source Projects: Cilium’s Final Guide to Credentials, Verification, and Remaining Gaps
VK Cloud has published the third and final part of its translated Cilium series on protecting the software supply chain in open source projects. The article details how Cilium isolates CI and production credentials using separate GitHub environments, enforces keyless signing with Sigstore Cosign and SBOM attestations, and applies strict release controls that prevent compromised workflows from reaching production images. It also covers the team’s ongoing security operations, additional hardening measures such as immutable tags and mandatory DCO sign-offs, and a gap analysis against OpenSSF Scorecard and SLSA standards. The post examines GitHub’s 2026 Actions security roadmap and explains how planned platform features like dependency blocking, scoped secrets, and native egress firewalls align with Cilium’s existing controls. The piece concludes by emphasizing defense-in-depth and the importance of openly sharing supply-chain security practices across the open source community.