This tutorial shows how to deploy OpenClaw on Kubernetes with a Helm chart and ArgoCD, using persistent storage, config modes, secrets handling, and network policies to reduce the blast radius of an AI agent.

More: https://ku.bz/4-b9pCNFz

Artem Lajko explains OS-level observability - the deepest layer of Kubernetes monitoring focused on infrastructure security and performance.

He describes how specialized tools like Falco and eBPF monitor system calls and kernel events to detect security threats. Using the example of unauthorized container shell access, Artem demonstrates how this layer provides platform teams and security engineers with deep insights while maintaining system performance.

Watch the full episode: https://ku.bz/9sGxhmm8s

Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions.

More: https://ku.bz/kh47Xb28t

This article covers network security fundamentals in Kubernetes, explaining how clusters default to a flat pod network, how network policies enforce segmentation, and best practices like “default deny” and restricting host networking.

More: https://ku.bz/T2VfCvjdJ

Netfence runs as a daemon, injecting eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates IP allowlists, and connecting to a central control plane to synchronize network rules.

More: https://ku.bz/wCc37BMNY

AI can quickly create Kubernetes changes, but it is still important to validate them.

Mauricio Salatino from Dash0 tests generated manifests before releasing them. He uses tools like vCluster Bind and provides clear examples to ensure the output matches established patterns.

Good governance begins with testing, understanding the context, and setting clear expectations.





Watch the full interview: https://ku.bz/Q7q0K2RyH

Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production.

More: https://ku.bz/_DdDJ5wzj

This guide walks through deploying Istio via Terraform and Helm to secure service-to-service and external communication with mTLS, automatic sidecar injection, and encrypted ingress via Istio Gateway.

More: https://ku.bz/wxcXWRYy2

This week on Learn Kubernetes Weekly 189:

🔥 Zero-Downtime Kubernetes Ingress Controllers on GCP
🏗️ Architecting GPUaaS for Enterprise AI On-Prem
📋 Conditions, Phases, and Declarative Phase Rules in Kubernetes Operators
⚙️ Container-Aware GOMAXPROCS
💀 Why Your Kubernetes Pod Was OOM Killed and Who Really Killed It

Read it now: https://kube.today/issues/189

⭐️ This issue is brought to you by Solanica - replace RDS with a self-hosted DBaaS on your own Kubernetes clusters with automated Day 2 operations and zero vendor lock-in https://ku.bz/NTszfwH40

This tutorial shows how to run OWASP ZAP scans inside GitHub Actions using SecureCodeBox on a Kubernetes kind cluster.

More: https://ku.bz/nDZJpmg5F

This article explains how to use Gatekeeper to enforce in-cluster admission policies, such as rejecting :latest images, mandating labels, and disallowing privileged workloads.

More: https://ku.bz/1Zskfkkvg

New on LearnKube: Server-side apply: what happens when you run kubectl apply

Server-side apply changes how Kubernetes handles field ownership.

Kubernetes objects are shared state. Manifests, controllers, release tools, autoscalers, webhooks, and operators can all shape the same object.

With client-side apply, stale intent can overwrite live changes.

With server-side apply, ownership moves into the API server. Kubernetes tracks which manager owns each field and surfaces conflicts when ownership is contested.

Chiara put serious work into this guide, and you can read it in full here: https://learnkube.com/server-side-apply-kubernetes

John Howard, Senior Software Engineer at Solo.io, explains that the biggest challenge in Kubernetes security isn't features but adoption.

He shares how Ambient Mesh originated from users repeatedly requesting "just mTLS" without the overhead of full-service mesh implementation. The team designed Ambient Mesh with compatibility and low footprint as core principles - it doesn't modify traffic patterns, works with any application, and can be deployed cluster-wide without breaking existing workloads. John emphasizes that establishing baseline security everywhere must precede implementing advanced features like sophisticated authorization policies or AI-based anomaly detection.

Watch the full episode: https://kube.fmhttps://ku.bz/sk-ZF1PG9

This week on Learn Kubernetes Weekly 190:

🌪️ Taming the Storm: Building Groww's Internal Chaos Engineering Platform
🧪 Taracode Testing a Go-Based CLI AI Agent in My Homelab
🧠 Building self-evolving AI systems: exploring the architecture
🔄 Migrating from slurm to Kubernetes
🏠 Lessons Learnt Self-hosting an AI Assistant

Read it now: https://kube.today/issues/190

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

This tutorial shows how to connect on-prem Kubernetes workloads to Google Cloud without service account keys using Workload Identity Federation, OIDC, Terraform, Kyverno, and IAM attribute conditions.

More: https://ku.bz/1YVD6c3FP

Kaniop is a Kubernetes operator written in Rust for managing Kanidm identity management clusters, providing declarative identity management through GitOps workflows.

More: https://ku.bz/pFkd88jPW

Copy Fail Blocker deploys a privileged DaemonSet that blocks AF_ALG and AF_RXRPC socket creation cluster-wide to mitigate Copy Fail and similar Linux kernel privilege-escalation paths.

More: https://ku.bz/hMfdC6WGc

This week on Learn Kubernetes Weekly 191:

🔥 What Does 4.4% GPU Utilization Actually Mean?
🛠️ GKE IP Exhaustion Fixed: The Class E Migration Guide
🧹 Evicting MCP Tool Calls from Your Kubernetes Cluster
🔄 The Feedback Loops Behind Kubernetes
🧠 You Don't Have a GIL Problem — You Have a CPU Problem
Read it now: https://kube.today/issues/191

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

This article explains Kubernetes v1.36 fine-grained kubelet authorization and how teams can replace broad nodes/proxy access with safer permissions for metrics, stats, logs, pods, and health checks.

More: https://ku.bz/M6WZq580X

This article explains the Kubernetes v1.36 SELinux volume labeling change and why clusters using SELinux should audit workloads before SELinuxMount becomes the default.

More: https://ku.bz/KGR_FN-3w

k8scout maps realistic Kubernetes escalation paths from a compromised pod to cluster-admin, node access, secret theft, or cloud IAM takeover, with graph output and reviewer mode.

More: https://ku.bz/Jt-LJm0f2