This week on Learn Kubernetes Weekly 205:

🚨 How Kubernetes Health Checks Brought Down a Payment Service
🏗️ The cluster that runs on our own metal: rebuilding survey processing on hybrid Kubernetes
⚡ The Fastest Redis Call Is the One You Never Make
🌐 CNI Deep Dive
🤔 Why did CPUs never have this problem?

Read it now: https://kube.today/issues/205

⭐️ This newsletter is brought to you by LearnKube — understand how Kubernetes works, and what to do when it breaks. Live training with 60% hands-on labs https://ku.bz/hypSbyc-V

This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express.

More: https://ku.bz/7HGvXhjVr

This article lays out an AI-assisted AWS DevSecOps pipeline on EKS, where Amazon Q reviews code, Inspector gates the image, DevOps Guru watches production and Step Functions decide when auto-remediation may run without a human.

More: https://ku.bz/LL-lCFNc0

This tutorial shows how to lock down outbound traffic with plain NetworkPolicy objects: deny all egress by default, restore DNS, then allow only what each workload needs.

More: https://ku.bz/cSTqKycHb

This article is a deep dive into how OpenChoreo does authorization: declarative RBAC with optional ABAC conditions, expressed as Kubernetes CRDs and evaluated by a Casbin engine.

More: https://ku.bz/D2tNKR8hY

Node security and pod security are not the same problem.

Rodrigo Bersa at AWS explains the difference:

Nodes are a compute boundary. Block traffic with security groups or firewall rules.

Pods are different. A hundred pods can run on the same node — node-level controls do nothing to separate them. That's where network policy comes in: east-west traffic control at the pod level, keeping front-end and database pods isolated even on shared hardware.

For deeper control: Service Mesh with Envoy adds application-layer authorization and mTLS for pod-to-pod encryption. L4 control plus L7 auth.





Watch the full interview: https://ku.bz/dB7PDNt0v

This write-up details CVE-2025-69902, a command-injection flaw in a kubectl MCP server that runs user input through a shell, letting an attacker execute arbitrary commands on the host.

More: https://ku.bz/2pxZf_bpJ

CPU and memory usage need context before you change Kubernetes requests and limits.

Throttling, pressure, and runtime events help explain the usage graph. Looking at each replica separately shows differences that a workload average can hide.

We are releasing the Kubernetes Resource Review Mixin, an open-source Grafana dashboard with Prometheus recording rules.

You can use it to:

- See how each Pod's CPU and memory usage compares to its requests and limits.
- Inspect CPU throttling, CPU and memory pressure when PSI metrics are available, and OOM and restart activity.
- Review replicas and workload revisions separately, with p95, maxima, and resource differences in the tables.

The mixin is an extension of our book on rightsizing Kubernetes workloads, The Technical Guide to Kubernetes Rightsizing.

Clone it here: https://github.com/learnk8s/resource-review-mixin

Hortator lets AI agents spawn sub-agents at runtime, with each agent running in its own pod with budget caps, network policies, PII redaction, and capability inheritance so children can never escalate beyond their parent's permissions.

More: https://ku.bz/KqYBl17Gv

This is a Hack The Box machine write-up that chains a LangFlow RCE and a forged JWT into a full Kubernetes cluster escape, step by step.

More: https://ku.bz/hw0Zs7JSb

LearnKube Day includes ten five-minute lightning talks from Kubernetes practitioners sharing practical lessons with the community.

Graziano Casto, Developer Advocate at Akuity, is one of the featured lightning-talk speakers at LearnKube Day Salt Lake City 2026.

The event brings together, lightning talks, YAML Games, and a community reception with a live DJ(our own Amin Astaneh).

Learn more: https://learnkube.com/learnkube-day-salt-lake-city-2026

This week on Learn Kubernetes Weekly 206:

🌐 DNS Is Weird Inside Kubernetes on AWS
⏳ TIL: Kubernetes ConfigMap Volume Mounts Are Eventually Consistent — Not Immediately Consistent
🚨 CVE-2025-69902: OS Command Injection in kubectl-mcp-tool
🐘 Building the Foundation for PostgreSQL Lifecycle Management in a DBaaS on Harvester
💰 We Cut Our Cassandra Bill From $30K to $10K a Month by Self-Hosting on Kubernetes

Read it now: https://kube.today/issues/206

⭐️ This issue is brought to you by Teleport — stop sharing credentials and give every engineer, service, and AI agent a login that expires automatically https://ku.bz/2tJxlTyDy