tag: #kubernetes

kube-bench runs the CIS Kubernetes Benchmark against your cluster and tells you, check by check, where the configuration falls short of the hardening baseline. It is one job to run, it is free, and every cluster should be scored by it at least once. It also has a clear limit worth understanding before you trust a green result.

An init container runs to completion before your app container starts, and only then does the app run. It is the clean place for setup that must happen first and must succeed. It is also reached for far too often, for things that belong in the image, in the app, or nowhere. Here is what it is for, what changed with native sidecars, and when not to use it.

The one fact that makes Kubernetes authentication click - there is no user object. The API server never stores users. It only verifies a credential from outside and reads a name off it. Once you know that, the whole model stops being confusing.

Distroless images ship no shell, so kubectl exec fails the moment you need it. kubectl debug injects an ephemeral container with its own tools into the running pod, shares the target's namespaces, and lets you read the app's filesystem through /proc — no restart, no debug build. Here it is end to end on a distroless nginx.