DevOps&SRE Library

nodes/proxy GET: One Kubernetes permission too many The nodes/proxy GET RBAC permission allows any ServiceAccount to execute code inside any Pod in the cluster, without leaving a single trace in the audit logs. This article details the issue, how to check if you are vulnerable, the fixes to apply, and the preventive measures you can put in place if you can't patch right away. https://blog.zwindler.fr/en/2026/05/19/nodes/proxy-get-one-kubernetes-permission-too-many

VLAN Migration: Moving a Live Kubernetes Cluster Without Downtime I migrated the entire k3s cluster from a flat network to a proper VLAN architecture: Server VLAN 20 for k3s nodes and services, Storage VLAN 30 for the NAS, and the existing default VLAN 1 for clients. This involved changing IPs on all VMs, updating MetalLB, reconfiguring Traefik, and recovering from an etcd quorum loss when I moved too many nodes at once. https://blog.zolty.systems/posts/2026-02-16-vlan-migration

User Namespaces in Kubernetes Part I: All You Need to Know https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-i Part II: Mappings and File Ownership https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-ii Part III: The Implementation https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-iii

Building an OSS Kubernetes Security Console with MCP That is what this series is about: building an open source Kubernetes security console that collects posture, vulnerability, policy, and runtime signals, exposes them through Kubernetes-native objects where possible, and wires that data into an MCP server so an AI agent can help triage across the whole stack. https://cloudsecburrito.com/building-an-oss-kubernetes-security-console-with-mcp

Building an AI Agent That Runs Your SRE Operations — What I Learned, What Works, and How You Can Do It Too Not a smarter alert. Not a better dashboard. An actual reasoning system — one that reads Splunk, queries AppDynamics, checks the Kubernetes pods, searches the Confluence runbooks, looks at what GitLab deployed recently, and comes back with a diagnosis and a proposed action. https://blog.stackademic.com/building-an-ai-agent-that-runs-your-sre-operations-what-i-learned-what-works-and-how-you-can-do-8a3801124bdc

We built an org-wide AI agent in 4 days. Here's what broke in the weeks after. We shipped the first version internally on March 12, four days after the first commit. This post isn't about those four days. It's about everything that broke once real people started using it, and the three weeks of fixes, security patches, and production incidents that followed. https://daily.dev/blog/we-built-an-org-wide-ai-agent-in-4-days-heres-what-broke-in-the-weeks-after

Practical Detection Engineering for Kubernetes A Primer on Log Sources and Ingestion Strategy https://brandontlyons.substack.com/p/practical-detection-engineering-for Scope, Not Volume: Detecting Credential Abuse in Kubernetes https://brandontlyons.substack.com/p/practical-detection-engineering-for-a55

SPF Record Syntax: Mechanisms, Qualifiers, Modifiers, and Macros This page is the full reference: every mechanism, every qualifier, both modifiers, the complete macro table, evaluation order, DNS lookup limits, and record placement rules — each with the RFC 7208 section that defines it. https://dmarcguard.io/blog/spf-record-syntax

buzz A workspace where humans and agents build together, on a relay you own. https://github.com/block/buzz

Что делать с петабайтами данных в MinIO, если разработка хранилища остановлена? MinIO прекратил активную разработку — продукт зафиксирован в текущем состоянии, патчи безопасности рассматриваются в индивидуальном порядке, обновления не тестируются. Для компаний, у которых на MinIO (или другом open-source S3-хранилище) хранятся петабайты данных, это уже не гипотетический риск, а вопрос времени. 3 сентября показываем на практике, как перенести данные из устаревшего хранилища в другое S3-совместимое — без остановки сервиса. В программе: 🔹 что переносится: объекты, версии, ACL, bucket-policy, lifecycle, теги, ссылки 🔹 техническое переключение с минимальным окном смены endpoint и параллельной работой на обоих хранилищах 🔹 поведение при сбоях синхронизации — перенос с точки останова, а не с нуля 🔹 демо: от подключения источника до полного переключения трафика Для DevOps- и SRE-инженеров, ИТ-директоров и всех, кому остановка сервиса недопустима даже на время миграции. 📅 3 сентября, 16:00 мск Регистрация