# namespaces Published articles for namespaces. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CVE-2026-124440 - Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass DevFeed: [CVE-2026-124440 - Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass]() Original publisher: [Read original article]() Author: CVEFEED.io; vulncheck.com Published: 2026-11-08T14:18:10Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Kyverno](), [Access Control](), [CVSS v4.0]() Tags: [2026](), [admin](), [admission](), [admission-controller](), [api](), [authorization](), [bypass](), [clamp](), [cluster](), [critical](), [cross](), [cve](), [cve-2026-124440](), [kyverno](), [mutating](), [namespaces](), [policies](), [privilege-escalation](), [resources](), [webhooks]() ### AI overview Kyverno versions 1.19.1 through before 1.19.2 have an authorization bypass in the apiCall namespace clamp. A namespace tenant can append malformed percent-escapes to urlPath to make a namespaced Policy issue cross-namespace or cluster-scoped API requests as the admission-controller ServiceAccount. The description says this can expose resources in other namespaces and allow creation of mutating webhooks, potentially escalating privileges to cluster admin. The excerpt gives no remediation details or exact affected-version table. ### Source excerpt CVE ID :CVE-2026-124440 Published : Nov. 8, 2026, 2:18 p.m. | 38 minutes ago Description :Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin. Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Taming Autonomous AI Agents with Rootless Docker DevFeed: [Taming Autonomous AI Agents with Rootless Docker]() Original publisher: [Read original article]() Author: Siva Sai Krishna Suryadevara Published: 2026-11-06T15:00:45Z Content type: article Language: en Sources: [HackerNoon]() Topics: [Docker](), [agentic-coding](), [cgroups](), [Agentic AI]() Tags: [agents](), [ai](), [ai-agents](), [ai-coding-agents](), [autonomous](), [autonomous-ai-agents](), [cgroups](), [coding](), [coding-agents](), [container-security](), [docker](), [docker-engine-api](), [docker-hardening](), [docker-security](), [linux](), [linux-containers](), [mcp-servers](), [namespaces](), [rootless-docker]() ### AI overview Rootless Docker can bound the host impact of autonomous coding agents, but only if they use the rootless daemon's socket and cannot fall back to the rootful system socket. User namespaces map container root to the service account and subordinate host IDs; cgroups v2 with systemd can limit resources, though limits may be silently ignored when the cgroup driver is `none` or controllers are not delegated. The article recommends a dedicated low-privilege account, explicit per-container memory, CPU and PID limits, and restrictive settings such as dropping capabilities, read-only filesystems and disabled networking where possible. Rootless networking uses user-mode drivers such as `slirp4netns`, with lower throughput and separate host firewall concerns. Configure agents and MCP servers to honor `DOCKER_HOST`, discover `$XDG_RUNTIME_DIR/docker.sock`, and allow the rootful socket only by policy; rootless Docker is an execution boundary, not an application-level policy proxy. ### Source excerpt How rootless Docker, Linux user namespaces, and cgroups v2 contain autonomous AI coding agents without escalating to host root privileges. ## From kubectl and Slack Threads to One Click: Building a Self-Serve NFR Environment DevFeed: [From kubectl and Slack Threads to One Click: Building a Self-Serve NFR Environment]() Original publisher: [Read original article]() Author: Vasuman Mishra Published: 2026-11-02T14:01:01Z Content type: article Language: en Sources: [Myntra]() Topics: [internal developer platform automation](), [self-service](), [Deployment Strategies](), [staging](), [kubectl]() Tags: [assemble](), [behaviour](), [cluster](), [deployment](), [design](), [developer-experience](), [devops](), [engineering-manager](), [environment](), [functional](), [ingress](), [internal-tools](), [kubectl](), [kubernetes](), [latency](), [load](), [machine](), [monitor](), [namespaces](), [platform](), [platform-engineering](), [pod](), [process](), [slack]() ### AI overview The self-serve NFR UI lets Engineering Managers assemble, monitor, and tear down services in a dedicated Kubernetes environment for pre-event scale, latency, and HPA checks. Each service moves through IDLE, ASSEMBLING, ASSEMBLED, or PARTIAL states; a lock protects state changes, and PARTIAL services must be disassembled to clean up resources before another assembly. Assembly creates a namespace, configures a Linkerd HTTPRoute and ingress, then scales the deployment and waits for ready pods. Disassembly deletes the route and namespace. The UI reuses existing production approval-group records for manager access, with parent-service lookup for child Odin groups and read-only access for others. Admins can group services into VLT deployment slots and bulk assemble from a CSV after preview; shared log polling supports simultaneous operations. The excerpt says this removes platform-team involvement in the common case, but safe traffic routing is reserved for Part 2. ### Source excerpt How we turned a manual, easy-to-break load-test setup into a UI any engineering manager can run themselvesPart 1 covers why the old kubectl-and-Slack process for NFR testing didn't scale. This piece is about what replaced it. We support 700+ NFR-deployable services, and a single sale-readiness window can touch dozens of them at once. So we built a self-serve UI that lets any Engineering Manager assemble, monitor, and tear down their own services in the NFR environment, with zero platform-team involvement in the common case. What "NFR environment" actually means NFR stands for Non-Functional Requirement -- the dedicated Kubernetes setup we spin up to validate scale, latency, and HPA (Horizontal Pod Autoscaler) behaviour before a high-traffic event, without touching production. How traffic actually gets routed there safely is its own story, covered in Part 2. Before the UI, assembling a service into NFR meant creating a namespace by hand, wiring up routing, configuring ingress, and scaling up the deployment , all while hoping you remembered every step in order for every single service. Designing around one idea: every deploy is a state machine The whole UI collapses down to a single state machine, and once we'd drawn it out, most of the hard design questions answered themselves. NFR service state machine A service is always in exactly one of five states. IDLE means it isn't running in NFR. Clicking Assemble moves it to ASSEMBLING, which lands on ASSEMBLED (traffic-ready) if everything goes well, or PARTIAL if any step fails. PARTIAL exists specifically so failure is never silent. A partial service can't be re-assembled directly; it has to be disassembled first, which cleans up whatever Kubernetes resources were left behind and returns it to IDLE. That one rule, that you can't assemble over a partial state, killed off a whole category of bugs where a cluster ends up with two or three orphaned namespaces for the same service. One small function enforces this, and every t ## CVE-2026-118668 - LangGraph JavaScript custom authentication may permit cross-user Store access DevFeed: [CVE-2026-118668 - LangGraph JavaScript custom authentication may permit cross-user Store access]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-10-28T21:16:57Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Langgraph](), [Authorization]() Tags: [2026](), [api](), [authentication](), [authorization](), [boundary](), [cross](), [cve](), [cve-2026-118668](), [deployment](), [fixed](), [isolation](), [javascript](), [langgraph](), [namespaces](), [store](), [user]() ### AI overview In langgraph-api versions 0.1.2 through before 0.15.0, JavaScript or TypeScript custom authentication handlers could rewrite a Store namespace for authorization, but that rewrite was not applied before the Store operation. An authenticated user could consequently read, overwrite, search, or delete data in another user's namespace when the deployment depended on rewriting for isolation. Python custom authentication and handlers that reject unauthorized namespaces are unaffected. The issue is fixed in version 0.15.0. ### Source excerpt CVE ID :CVE-2026-118668 Published : Oct. 28, 2026, 9:16 p.m. | 2 hours, 12 minutes ago Description :langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Volcano v1.16 Released: NamespaceQueue, fairshare, and a broader HyperNode ecosystem DevFeed: [Volcano v1.16 Released: NamespaceQueue, fairshare, and a broader HyperNode ecosystem]() Original publisher: [Read original article]() Author: Volcano Maintainers Published: 2026-10-28T20:45:08Z Content type: release Language: en Sources: [Cloud Native Computing Foundation]() Topics: [releases](), [kueue](), [Cloud]() Tags: [administrator](), [blog](), [ecosystem](), [namespaces](), [plugin](), [queue](), [queues](), [quotas](), [resource](), [volcano]() ### AI overview Volcano v1.16.0 adds namespace-scoped queue hierarchies and fairshare scheduling for tenants that share a queue. NamespaceQueue lets administrators authorize namespaces against cluster Queues while tenants manage quotas and child queues; it is disabled by default and initially requires hierarchical capacity. The fairshare plugin tracks decaying resource-seconds by namespace to influence pending-job order, optionally gate admission, and optionally persist state; it does not preempt running jobs. Other additions include a disabled-by-default Unschedulable Job Cache, which uses plugin event hints to skip repeated checks and retry on relevant changes, with a five-minute default watchdog; unsupported rejection types continue to be checked each session. PodGroup anti-affinity can separate groups across HyperNode domains during allocation, but offers no isolation guarantee for BestEffort backfill placements. A standalone HyperNode controller lets other schedulers reuse topology discovery and supernode management through the API. The release also adds Kubernetes 1.36 support and other scheduling and accelerator improvements. ### Source excerpt Volcano v1.16.0 is available . v1.16.0 introduces NamespaceQueue and the fairshare plugin. Tenants can use hierarchical queues within their own namespaces to organize quotas and queue hierarchies within administrator-authorized resource pools. Fairshare brings historical resource consumption... ## Namespaces in Python DevFeed: [Namespaces in Python]() Original publisher: [Read original article]() Author: Leodanis Pozo Ramos Published: 2026-10-10T14:00:00Z Content type: tutorial Language: en Sources: [Real Python]() Topics: [Python](), [To-Do]() Tags: [learn](), [namespaces](), [python](), [scope]() ### AI overview This tutorial explains Python namespaces, which map names to objects, and how they relate to scope and name resolution. It covers built-in, global, local, and enclosing namespaces, the LEGB lookup order, and using globals(), locals(), global, and nonlocal to inspect or modify names. ### Source excerpt Python namespaces store and organize the symbolic names in your program. Learn when they're created, how they work, and how scope follows. ## Symfony 7.4.20 released DevFeed: [Symfony 7.4.20 released]() Original publisher: [Read original article]() Author: Fabien Potencier Published: 2026-09-29T14:07:35Z Content type: release Language: en Sources: [Symfony]() Topics: [Symfony]() Tags: [7-4](), [about](), [api](), [bug](), [cache](), [cache-invalidation](), [code](), [collection](), [dutch](), [elements](), [mermaid](), [namespaces](), [null](), [oidc](), [recursion](), [redis](), [release](), [security](), [symfony](), [union-types]() ### AI overview Symfony 7.4.20 has been released. The release notes list fixes and minor changes across components including Mailer, Form, DependencyInjection, Messenger, Security, Cache, and TypeInfo, and point users to upgrade guidance and SymfonyInsight reports. ### Source excerpt Symfony 7.4.20 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip... ## Implement per-pod image pull permissions with ECR repository policies on Amazon EKS DevFeed: [Implement per-pod image pull permissions with ECR repository policies on Amazon EKS]() Original publisher: [Read original article]() Author: Asiel Bencomo Corona Published: 2026-09-22T16:58:07Z Content type: tutorial Language: en Sources: [Containers]() Topics: [Amazon Elastic Kubernetes Service](), [Kubernetes](), [AWS IAM](), [container images](), [Authorization]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-container-registry](), [amazon-elastic-kubernetes-service](), [aws-identity-and-access-management-iam](), [container-image](), [container-registry](), [eks](), [kubernetes](), [namespaces](), [permissions](), [policies](), [technical-how-to]() ### AI overview This tutorial explains how to give individual Kubernetes pods scoped permission to pull container images from Amazon ECR in a multi-tenant Amazon EKS cluster. It covers per-pod credential support introduced by KEP 4412 and AWS-native ECR repository policies. ### Source excerpt Learn how to scope Amazon ECR image pull permissions to individual Kubernetes pods on a multi-tenant Amazon EKS cluster using KEP 4412 credential providers and ECR repository deny policies, so teams sharing the same nodes can pull only their own container images. ## ReadyOn's Four Walls of tenant isolation on Amazon EKS DevFeed: [ReadyOn's Four Walls of tenant isolation on Amazon EKS]() Original publisher: [Read original article]() Author: Roshan Daneshvaran Published: 2026-09-18T21:33:13Z Content type: article Language: en Sources: [AWS Architecture Blog]() Topics: [Amazon Elastic Kubernetes Service](), [Multi-tenancy](), [Security](), [Amazon VPC](), [software-architecture](), [Amazon Aurora](), [rbac]() Tags: [amazon-aurora](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [amazon-vpc](), [defense-in-depth](), [isolation](), [kubernetes](), [multi-tenancy](), [namespaces](), [security]() ### AI overview ReadyOn describes a four-layer tenant-isolation architecture for its multi-tenant platform on Amazon EKS. The model combines Kubernetes namespaces, dedicated node pools, Amazon VPC security groups, and per-tenant Amazon Aurora databases to protect sensitive enterprise data. ### Source excerpt ReadyOn runs a multi-tenant platform on Amazon EKS that handles highly sensitive enterprise data. This post describes their Four Walls model: four independent layers of tenant isolation combining Kubernetes namespaces, Karpenter node pools, Amazon VPC security groups, and per-tenant Amazon Aurora databases for zero-trust defense in depth. ## Kubernetes Cost Optimization: A Practical Guide for Teams DevFeed: [Kubernetes Cost Optimization: A Practical Guide for Teams]() Original publisher: [Read original article]() Author: Kelsey Rosen Published: 2026-09-17T00:00:00Z Content type: article Language: en Sources: [Harness]() Topics: [Kubernetes](), [cost-optimization](), [autoscaling](), [DevOps](), [Cloud](), [finops]() Tags: [autoscaling](), [capacity](), [cloud](), [cost](), [cost-optimization](), [devops](), [guide](), [kubernetes](), [memory](), [namespaces](), [practical]() ### AI overview A practical guide to reducing Kubernetes costs through right-sizing CPU and memory requests, autoscaling, discounted spot or preemptible nodes, and namespace-level cost allocation. It explains how scheduler reservations, shared clusters, and incomplete ownership mapping can hide waste. ### Source excerpt Practical Kubernetes cost optimization: right-sizing, autoscaling, spot and preemptible nodes, and namespace-level cost allocation for DevOps teams. | Blog ## The Apache Polaris REST API: How Engines Talk to the Catalog DevFeed: [The Apache Polaris REST API: How Engines Talk to the Catalog]() Original publisher: [Read original article]() Author: Alex Merced Published: 2026-09-10T15:42:18Z Content type: article Language: en Sources: [Dremio]() Topics: [Apache Iceberg](), [GitHub API](), [OpenAPI Specification](), [HTTP]() Tags: [apache-iceberg](), [apache-polaris](), [api](), [client](), [data-lakehouse](), [dremio-blog-open-data-insights](), [http](), [iceberg](), [locks](), [migration](), [namespaces](), [openapi](), [rest](), [table]() ### AI overview This article explains the Apache Polaris implementation of the Iceberg REST Catalog specification. It covers the API's endpoint groups, namespace and table management, assertion-based commits, storage credentials, server-side scan planning, and deprecated specification components. ### Source excerpt Apache Polaris implements the Iceberg REST Catalog specification, a set of HTTP endpoints that any Iceberg client can speak. The specification covers namespace and table management, an atomic commit protocol built on assertions rather than locks, server-side scan planning, and three different ways for a client to obtain storage access. Because the contract is the [...] The post The Apache Polaris REST API: How Engines Talk to the Catalog appeared first on Dremio. ## IP allow list coverage for EMU namespaces in general availability DevFeed: [IP allow list coverage for EMU namespaces in general availability]() Original publisher: [Read original article]() Author: Allison Published: 2026-06-08T16:26:25Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [GitHub]() Tags: [access-tokens](), [account](), [availability](), [cloud](), [configuration](), [coverage](), [emus](), [enterprise](), [enterprise-cloud](), [feature](), [general-availability](), [github](), [github-enterprise-cloud](), [ip](), [list](), [namespaces](), [native](), [user](), [user-namespaces](), [users]() ### AI overview GitHub Enterprise Cloud now generally supports enforcing an enterprise IP allow list across Enterprise Managed User (EMU) namespaces. EMU users can access their account's repositories only from allowed IP addresses. The restriction applies to web UI, Git protocol, and API access, and covers personal access tokens, app tokens, and SSH keys. ### Source excerpt GitHub Enterprise Cloud with Enterprise Managed Users (EMUs) can now enforce GitHub's native IP allow list configuration across user namespaces. This feature is now generally available. EMUs allow the enterprise... ## Modernizing the Command Line: Heroku CLI v11 DevFeed: [Modernizing the Command Line: Heroku CLI v11]() Original publisher: [Read original article]() Author: Eric Black Published: 2026-03-19T22:29:49Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [Command-line interface](), [Legacy Modernization]() Tags: [architecture](), [build-system](), [cli](), [color](), [command-line](), [ecmascript](), [esm](), [faster](), [heroku](), [javascript](), [legacy](), [migration](), [modernization](), [modernizing](), [modules](), [namespaces](), [news](), [node-js](), [performance](), [release](), [semantic](), [standards]() ### AI overview Heroku CLI v11 completes a move to ECMAScript Modules (ESM) and oclif v4. The release attributes faster installs and command execution to tree-shaking, optimized module loading, and manifest caching; it also supports interoperability between CommonJS and ESM plugins. The build system moved from Yarn and a monorepo to npm and a single package. Terminal output gains a consistent semantic color palette and theme support. The excerpt notes breaking changes to legacy namespaces, but does not specify their scope or migration steps. ### Source excerpt Heroku CLI v11 is now available. This release represents the most significant architectural overhaul in years, completing our migration to ECMAScript Modules (ESM) and oclif v4. This modernization brings faster performance, a new semantic color system, and aligns the CLI with modern JavaScript standards. While v11 introduces breaking changes to legacy namespaces, the benefits are [...] The post Modernizing the Command Line: Heroku CLI v11 appeared first on Heroku. ## How to run rootless containers DevFeed: [How to run rootless containers]() Original publisher: [Read original article]() Author: Matt Kim Published: 2026-02-10T00:00:00Z Content type: tutorial Language: en Sources: [Sysdig]() Topics: [container](), [container-security](), [Security](), [Docker](), [Process](), [runc]() Tags: [container-escape](), [container-security](), [containers](), [docker](), [exploit](), [falco](), [how-to](), [kubernetes](), [namespaces](), [permissions](), [root-user](), [rootless-containers-unprivileged-containers-container-security-best-practices-running-containers-as](), [runc](), [security](), [security-best-practices]() ### AI overview A tutorial on running rootless containers as a container security practice. It explains the risks of running container processes as root, including greater impact after compromise and possible container escape, then discusses adapting images, file permissions, ports, user namespaces, capabilities, and tradeoffs. ### Source excerpt Using rootless containers, or unprivileged containers, is one of the most effective container security best practices. ## From Linux Primitives to Kubernetes Security Contexts DevFeed: [From Linux Primitives to Kubernetes Security Contexts]() Original publisher: [Read original article]() Author: Dave Altena Published: 2025-08-11T00:00:00Z Content type: article Language: en Sources: [Learnk8s]() Topics: [Security](), [container](), [Linux](), [cgroups]() Tags: [api](), [capabilities](), [cgroups](), [configure](), [container](), [containers](), [context](), [docker](), [field](), [filesystem](), [filesystems](), [kernel](), [kubernetes](), [kubernetes-security](), [linux](), [low-level](), [namespaces](), [networking](), [pods](), [security]() ### AI overview Containers in Kubernetes run as Linux processes on the host kernel, isolated with namespaces, cgroups, and a separate virtual filesystem. Kubernetes does not impose a non-root policy: the image's default user applies unless overridden. A pod's `securityContext` declaratively configures process behavior, but Kubernetes passes those settings to the container runtime, which maps them to kernel features. The excerpt identifies controls for choosing the container user, managing Linux capabilities, using read-only filesystems, and blocking privilege escalation; it explains that root access can increase host privilege-escalation risk if a container is compromised. The supplied text ends as it begins discussing syscalls, so it does not provide the configuration details or practical YAML steps. ### Source excerpt Dive deep into Kubernetes Security Contexts and learn how to manage security settings for your pods and containers. ## Making Sense of Kubernetes Initial Access Vectors Part 2 - Data Plane DevFeed: [Making Sense of Kubernetes Initial Access Vectors Part 2 - Data Plane]() Original publisher: [Read original article]() Author: Shay Berkovich Published: 2024-11-13T17:04:16Z Content type: article Language: en Sources: [Wiz]() Topics: [Kubernetes](), [container](), [container images](), [Application Security](), [Vulnerabilities](), [rbac](), [Security](), [execution]() Tags: [application-security](), [container-images](), [containers](), [kubernetes](), [kubernetes-clusters](), [lateral-movement](), [namespaces](), [network](), [privilege-escalation](), [rbac](), [rce](), [remote-code-execution](), [run](), [security]() ### AI overview This article examines initial access vectors into Kubernetes data planes, focusing on applications, container images, and execution-as-a-service workloads. It explains how attackers may use vulnerabilities, RBAC privileges, system privileges, and weak security boundaries to move laterally or escalate privileges. ### Source excerpt Learn about Kubernetes data plane access, including applications running on the cluster, container images, and execution-as-a-service workload types. ## Ep. 4: Mastering Kubernetes Networking: Essential Insights for Efficient Deployment DevFeed: [Ep. 4: Mastering Kubernetes Networking: Essential Insights for Efficient Deployment]() Original publisher: [Read original article]() Published: 2024-06-03T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [container-networking](), [Kubernetes]() Tags: [api](), [cluster](), [communication](), [configuration](), [deployment](), [discovery](), [dns](), [go](), [kind](), [kubernetes](), [kubernetes-clusters](), [kubernetes-networking](), [local](), [namespaces](), [networking](), [patching](), [routing](), [service](), [services](), [traffic]() ### AI overview The excerpt explains that opening ports in a kind configuration alone does not make Kubernetes endpoints accessible: service definitions are also needed to route traffic. Bill demonstrates adding port information and a basic Service to the base YAML, including separate ports for an API and a debug API. Named Services and namespaces let Kubernetes manage DNS for pod-to-pod discovery, avoiding hardcoded pod IPs as applications scale. The excerpt also mentions patching Service definitions and using Customize to manage configuration; it does not provide further detail on those steps. ### Source excerpt Introduction: In this detailed discussion, Bill delves into the critical aspects of networking within Kubernetes clusters, emphasizing the necessity of properly defining services to manage internal and external communication effectively. Learn the critical role of service definitions in Kubernetes for managing internal and external communication, ensuring your Go applications are accessible and networked correctly within the cluster. Gain insights into configuring Kubernetes environments to handle traffic routing and service discovery, which is essential for deploying scalable and maintainable Go applications. ## NamespaceHound: protecting multi-tenant K8s clusters DevFeed: [NamespaceHound: protecting multi-tenant K8s clusters]() Original publisher: [Read original article]() Author: Megan Moore Published: 2024-03-13T17:57:49Z Content type: article Language: en Sources: [Wiz]() Topics: [Kubernetes](), [Multi-tenancy](), [Security](), [Open Source](), [rbac](), [control-plane]() Tags: [kubernetes-clusters](), [multi-tenancy](), [namespaces](), [open-source](), [rbac](), [research](), [security]() ### AI overview NamespaceHound is an open-source tool for assessing potential namespace-crossing violations and anonymous access in multi-tenant Kubernetes clusters. The document explains how namespaces, RBAC, and quotas support tenant isolation and why monitoring namespace boundaries is challenging. ### Source excerpt NamespaceHound is an open-source tool for detecting the risk of potential namespace crossing violations and anonymous access opportunities in multi-tenant clusters. ## What is a container? DevFeed: [What is a container?]() Original publisher: [Read original article]() Author: Marc Brooker Published: 2023-06-19T00:00:00Z Content type: article Language: en Sources: [Marc Brooker's]() Topics: [container](), [container images](), [container native](), [cgroups](), [Linux Kernel]() Tags: [applications](), [aws](), [aws-lambda](), [cgroups](), [container](), [container-image](), [deployment](), [development](), [docker](), [ecs](), [isolation](), [kernel](), [linux](), [namespaces](), [operating-system](), [packaging](), [practices](), [security](), [semantics](), [tools]() ### AI overview "Container" can mean four related but independent things: packaging an application with dependencies for a minimal runtime; practices built around that packaging; operating-system isolation tools such as Linux chroot, cgroups, namespaces, and seccomp; or implementations such as Docker, Kubernetes, and ECS. Packaging predates the other categories, and practices do not require particular tools. Linux interfaces underpin many implementations, though the excerpt says most semantics can be provided in other ways. AWS Lambda's container image support mainly concerns packaging. The claim that containers are not a security boundary mainly concerns isolation tools and implementations, while packaging and related practices can benefit security. The practical advice is to clarify which meaning is intended. ### Source excerpt What is a container? What are words, anyway? A common cause of confusion and miscommunication I see is different people using different definitions of words. Sometimes the definitions are subtly different (as with availability). Sometimes they're completely different, and we're just talking about different things entirely. A common example is the word container, a popular term for a popular technology that means at least four different things. An approach to packaging an application along with its dependencies (sometimes a whole operating system user space), that can then run on a minimal runtime environment with a clear contract4. A set of development, deployment, architectural, and operational approaches built around applications packaged this way. A set of operational, security, and performance isolation tools that allow multiple applications to share an operating system without interfering with each other. On Linux, this tools include chroot, cgroups, namespaces, seccomp, and others. A set of implementations of these practices (the proper nouns, Docker, Kubernetes, ECS, etc). These four definitions are surprisingly independent. The idea of packaging applications this way predates the other three, and will likely be around after they are gone. The practices and approaches are enabled by the tools, but don't really require them. The Linux kernel-level interfaces, and the semantics and security they provide, are a basis for many of the implementations today, but most of the semantics are available in different ways1. To pick an example, when we talk about container image support in AWS Lambda3 we mostly mean the first one: enabling customers to get the advantages of packaging their code that way, with a small overlap with practices (some become easier to use with this support available), and the fourth (some of these tools can be used to create the images in ways that fit into a broader ecosystem). Or, to pick another example, when people say containers are not a s ## GitHub Actions: You can now disable repo level self-hosted runners in an Enterprise and Organization DevFeed: [GitHub Actions: You can now disable repo level self-hosted runners in an Enterprise and Organization]() Original publisher: [Read original article]() Author: Kevin Duck Published: 2023-06-13T14:53:25Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [self-hosted runner](), [CI/CD]() Tags: [enterprise](), [existing](), [github](), [github-actions](), [jobs](), [namespaces](), [organization](), [organizations](), [repo](), [repository](), [self-hosted](), [user](), [users]() ### AI overview Enterprise administrators can disable repository-level self-hosted runners across organizations and enterprise user namespaces. Once enabled, users cannot register new repository-level self-hosted runners, and existing runners cannot receive new jobs. ### Source excerpt Enterprise administrators can now disable repository level self-hosted runners across organizations and enterprise user namespaces. Once this new setting has been enabled users will no longer be able to register... ## Use discovery selectors to configure namespaces for your Istio service mesh DevFeed: [Use discovery selectors to configure namespaces for your Istio service mesh]() Original publisher: [Read original article]() Author: Lin Sun (Solo.io), Christian Posta (Solo.io), Harvey Xia (Solo.io) Published: 2021-04-30T00:00:00Z Content type: tutorial Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [selectors](), [control-plane](), [Kubernetes](), [software-architecture]() Tags: [control-plane](), [discoveryselectors](), [istio](), [kubernetes](), [mesh](), [microservices](), [namespaces](), [performance](), [selectors](), [service-mesh](), [services](), [sidecar]() ### AI overview This tutorial explains how Istio discovery selectors restrict the namespaces included in a service mesh. It describes how limiting the resources watched by Istiod can reduce control-plane and sidecar updates and improve performance, especially in large or frequently changing Kubernetes clusters. ### Source excerpt As users move their services to run in the Istio service mesh, they are often surprised that the control plane watches and processes all of the Kubernetes resources, from all namespaces in the cluster, by default. This can be an issue for very large clusters with lots of namespaces and deployments, or even for a moderately sized cluster with rapidly churning resources (for example, Spark jobs). Both in the community as well as for our large-scale customers at Solo.io, we need a way to dynamically restrict the set of namespaces that are part of the mesh so that the Istio control plane only processes resources in those namespaces. The ability to restrict the namespaces enables Istiod to watch and push fewer resources and associated changes to the sidecars, thus improving the overall performance on the control plane and data plane. Background By default, Istio watches all Namespaces, Services, Endpoints and Pods in a cluster. For example, in my Kubernetes cluster, I deployed the sleep service in the default namespace, and the httpbin service in the ns-x namespace. I've added the sleep service to the mesh, but I have no plan to add the httpbin service to the mesh, or have any service in the mesh interact with the httpbin service. Use istioctl proxy-config endpoint command to display all the endpoints for the sleep deployment: Endpoints for Sleep Deployment Note that the httpbin service endpoint in the ns-x namespace is in the list of discovered endpoints. This may not be an issue when you only have a few services. However, when you have hundreds of services that don't interact with any of the services running in the Istio service mesh, you probably don't want your Istio control plane to watch these services and send their information to the sidecars of your services in the mesh. Introducing Discovery Selectors Starting with Istio 1.10, we are introducing the new discoverySelectors option to MeshConfig, which is an array of Kubernetes selectors. The exact type is []Label ## How C++ Resolves a Function Call DevFeed: [How C++ Resolves a Function Call]() Original publisher: [Read original article]() Author: Jeff Preshing Published: 2021-03-15T12:10:00Z Content type: article Language: en Sources: [Jeff Preshing]() Topics: [Tutorial](), [Algorithms](), [Type Argument](), [Jule]() Tags: [algorithm](), [built-in](), [c](), [c-plus-plus](), [call](), [career](), [compile](), [compiler](), [features](), [function](), [functions](), [namespaces](), [operator](), [operators](), [runtime](), [sort](), [string](), [strings](), [template](), [templates]() ### AI overview C++ resolves function calls at compile time through a sequence of steps: name lookup gathers candidates, including functions found through argument-dependent lookup for unqualified calls; template argument deduction and substitution turn viable templates into functions or remove them when deduction or substitution fails (SFINAE); and overload resolution filters by argument compatibility and constraints before selecting the best viable function. The example shows a namespace function and a function template with identical parameter types; the non-template wins the tie. Better argument conversions take precedence over template status, and a more specialized template can win when earlier rules do not decide the call. If no unambiguous best candidate exists, compilation fails. The article presents a high-level explanation and notes that detailed rules for lookup, conversions, deduction, and specialization are omitted. ### Source excerpt C is a simple language. You're only allowed to have one function with each name. C++, on the other hand, gives you much more flexibility: You can have multiple functions with the same name (overloading). You can overload built-in operators like + and ==. You can write function templates. Namespaces help you avoid naming conflicts. I like these C++ features. With these features, you can make str1 + str2 return the concatenation of two strings. You can have a pair of 2D points, and another pair of 3D points, and overload dot(a, b) to work with either type. You can have a bunch of array-like classes and write a single sort function template that works with all of them. But when you take advantage of these features, it's easy to push things too far. At some point, the compiler might unexpectedly reject your code with errors like: error C2666: 'String::operator ==': 2 overloads have similar conversions note: could be 'bool String::operator ==(const String &) const' note: or 'built-in C++ operator==(const char *, const char *)' note: while trying to match the argument list '(const String, const char *)' Like many C++ programmers, I've struggled with such errors throughout my career. Each time it happened, I would usually scratch my head, search online for a better understanding, then change the code until it compiled. But more recently, while developing a new runtime library for Plywood, I was thwarted by such errors over and over again. It became clear that despite all my previous experience with C++, something was missing from my understanding and I didn't know what it was. Fortunately, it's now 2021 and information about C++ is more comprehensive than ever. Thanks especially to cppreference.com, I now know what was missing from my understanding: a clear picture of the hidden algorithm that runs for every function call at compile time. This is how the compiler, given a function call expression, figures out exactly which function to call: may performargument-dependentloo ## K8Guard DevFeed: [K8Guard]() Original publisher: [Read original article]() Author: Target Brands, Inc Published: 2017-06-27T05:00:00Z Content type: release Language: en Sources: [Target]() Topics: [K8Guard](), [Prometheus](), [Apache Kafka](), [Grafana]() Tags: [api](), [audit](), [automation](), [availability](), [cloud](), [clusters](), [container](), [dashboards](), [deployments](), [docker](), [efficiency](), [email](), [infrastructure](), [ingress](), [jobs](), [k8guard](), [kafka](), [kubernetes](), [metrics](), [microservices](), [monitors](), [namespaces](), [notifications](), [open-source](), [platform](), [pods](), [prometheus](), [security]() ### AI overview K8Guard is an open-source Kubernetes auditing system that checks resources such as deployments, pods, jobs, ingresses, and namespaces for violations involving security, efficiency, availability, or stability. It notifies namespace owners and, after a configurable number of notices, can scale deployments to zero, suspend jobs, or delete ingresses; safe mode limits it to notifications. Its discover service can publish violations to Kafka or serve them through an API without Kafka. The action service processes Kafka messages and records actions in Cassandra, while the report service provides searchable records of past actions. The excerpt also describes 19 discover API metrics, including resource and violation counts, plus API-call timing measurements for Prometheus and Grafana dashboards. ### Source excerpt K8Guard is Officially Open Source I am happy to announce that Target has open sourced K8Guard. I have been part of designing and developing it for the past few months, and I'm going to share a little more about it. What is K8Guard? K8Guard is an auditing system for Kubernetes clusters. It monitors different entities on your cluster for possible violations. K8Guard notifies the violators and then takes action on them. It also provides metrics and dashboards about violations in the cluster through Prometheus. How to Pronounce It? Like Kate Guard - the guardian angel for your Kubernetes clusters. Why? If you have large size kuberentes clusters and you care about security, efficiency, availability and stability, you need a tool to detect violations and do appropriate actions on them. What Kind of Violations Does It Discover? Violation Why Example Image Size Efficiency 5 GB image size Image Repo Security Downloading image from a shady repo Extra Capabilities Security Setting UID/GUID Privileged Mode Security Root containers Single Replica Availability Not 12-factor app Invalid Ingress Security/Stability Having *" in ingress Mount Host Vols Security/Stability Mounting Kubernetes system files No Owner Security No owner annotation for namespace What Kind of Entities Does It Monitor? Any entities which deployed to your kubernetes cluster such as Deployments, Pods, Jobs/CronJobs, Ingresses and namespaces. What Kind of Actions Does It Take? Notifies the namespace owner (email, hipchat, ...). After X amount of notifications, it will do a hard action such as: Scale bad deployments down to zero. Suspend bad jobs. Delete bad ingress Note that there is a safe mode - which only notifies and does not do hard actions. The K8Guard Design K8Guard has 3 main microservices (discover, action, report) Discover service, when in messaging mode, finds violations and puts them on a kafka topic. and also discover API mode, is able to serve without depending on kafka. you can hit the end points to