Security, Hybrid Cloud, and Kubernetes Tooling for…

Key events and trends

• gVisor Donated to CNCF Sandbox for Enhanced Container Isolation gVisor, a container sandbox developed by Google that runs an application kernel in userspace to isolate applications and the host OS, has been donated to the CNCF Sandbox. This open-source project, used in Google products like GKE, Cloud Run, Gemini, YouTube, and Gmail, plans to move to CNCF Incubated projects in the coming months. (источник)

• AWS Introduces EKS Hybrid Nodes to Address On-Prem Kubernetes Challenges EKS Hybrid Nodes aim to solve common pain points for on-premises Kubernetes deployments by allowing AWS to manage the control plane (patching, scaling, hardening) while worker nodes remain on-premises. The solution includes native identity handling via EKS Pod Identity and IAM roles for service accounts, reuse of existing VPN/Direct Connect for networking, and node upgrades managed by nodeadm. This allows users to maintain infrastructure control while offloading control plane management to AWS. (источник)

• Tutorial on Kubernetes Admission Control with Kyverno and Custom Webhooks A new tutorial demonstrates how to build a Kubernetes admission control setup on a local Kind cluster. It leverages Kyverno policies to enforce security standards, such as blocking latest tags, root containers, and host networking, and integrates a custom Python webhook for more complex checks that Kyverno cannot express natively. (источник)

• Guidance on Building an Open Source Security Stack for AppSec and DevSecOps A Senior AppSec and DevSecOps engineer has provided insights into assembling a foundational security stack using open-source tools. This guide covers how to configure access controls, collect and analyze security events, and respond to incidents, offering a cost-effective alternative for organizations without the budget for commercial solutions like Wiz or CrowdStrike. (источник)

• Strands Box Offers Open Source AI Agent Sandboxes Powered by Dogwood Strands Box, an open-source (Apache 2.0) developer preview sandbox for AI agents, has been introduced. It provides OS-level isolation (e.g., macOS Seatbelt) combined with Dogwood policies that regulate actions across egress, Python, Shell, and MCP enforcement points, enhancing the security of AI agent deployments. (источник)

• kubectl-config-doctor CLI Plugin for Kubeconfig Troubleshooting A new CLI plugin named kubectl-config-doctor helps detect and diagnose issues within kubeconfig setups. It can identify problems such as duplicate contexts, invalid authentication methods, missing files, or unreachable Kubernetes API endpoints. (источник)

• KubeDesk: Cross-Platform Desktop App for Kubernetes Management KubeDesk is a new cross-platform desktop application designed for managing Kubernetes resources. It enables users to browse resources, visualize health and topology, stream logs, open shell access, and perform dry-run validated changes. (источник)

• Cloudflare Logpush Integrates Transformers for Advanced Log Filtering and Processing Cloudflare has enhanced its Logpush service by adding Transformers, which allow users to apply SQL-like queries to filter and modify log data before export. This feature enables excluding unwanted records (using WHERE), selecting specific fields, and altering their content, such as masking IP addresses, before the logs are delivered to storage in NDJSON format. (источник)

• Learn Kubernetes Weekly 205 Highlights Key Industry Topics The latest edition of Learn Kubernetes Weekly (issue 205) features articles on critical topics including how Kubernetes health checks can impact payment services, strategies for rebuilding survey processing on hybrid Kubernetes setups, a deep dive into CNI, and discussions on historical CPU problems. (источник)

• Upcoming Webinar on Monitoring Security Events in MWS Cloud Platform A free webinar is scheduled for October 20 at 12:00 MSK to discuss the MWS Cloud Platform's audit log service. The session will cover its capabilities and demonstrate how to export security events to SIEM systems, targeting CISO, IS specialists, DevOps engineers, and SOC specialists. (источник)

Final analytics

The day's news highlights a strong focus on enhancing server infrastructure security, particularly within Kubernetes and cloud environments. Google's donation of gVisor to CNCF underscores a continued industry commitment to robust container isolation, a critical component of DevSecOps. Similarly, AWS's EKS Hybrid Nodes address the complexities of managing Kubernetes across hybrid cloud landscapes, providing a more secure and efficient way to extend cloud control planes to on-premises infrastructure.

Security practices are further emphasized with tutorials on Kubernetes admission control using Kyverno, directly tackling container protection and vulnerability mitigation. The discussion around building open-source security stacks confirms that effective AppSec and DevSecOps are achievable even with budget constraints, promoting accessibility to crucial security tooling. The introduction of Strands Box for AI agent sandboxing indicates an evolving security landscape, extending isolation principles to emerging AI-driven applications.

Operational efficiency and monitoring also received attention with new tools like kubectl-config-doctor for Kubernetes configuration troubleshooting and KubeDesk for general management. Cloudflare's Logpush Transformers enhance monitoring and security logging capabilities by allowing pre-export data filtering, directly contributing to better incident response and compliance. The overall tone reflects a proactive approach to securing and managing complex, distributed server infrastructures.