Cilium

EnvSpec Naming Standard Introduces Strict Six-Environment Hierarchy for Zero Trust Infrastructure

The EnvSpec Naming 1.0.0 standard proposes replacing ad-hoc hostnames with a strict hierarchical naming system based on environment, perimeter, system, slot and node. It defines exactly six environments—dev, test, stage, prod, infrastructure and workplace—and treats any test or pilot system processing real data as prod. The model projects names into SPIFFE IDs, Kubernetes namespaces, cloud projects and mandatory tags for automated policy enforcement. Rules prohibit direct communication between different linear environments and require all access from workplace devices through dedicated gateways. The standard is published under CC BY-SA 4.0 and includes machine-checkable criteria for compliance.

WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors

The WireGuard kernel module stores AllowedIPs in a single prefix trie per device rather than per peer, causing exact-match insertions of identical CIDR prefixes to reassign nodes and remove them from the previous peer's list. This behavior silently drops routing for affected peers while handshakes and inbound traffic continue, leading to one-way connectivity failures and frame errors. The issue affects road-warrior setups using 0.0.0.0/0, mesh networks, Kubernetes CNI plugins such as Cilium and Calico, and network operating systems including VyOS and OPNsense. No warning is emitted by wg, wg-quick, or the kernel on overwrite, and the longest-prefix-match lookup ensures only equal-length prefixes collide. The root cause resides in allowedips.c where rcu_assign_pointer redirects the trie node and list_move_tail detaches it from the original peer. The same logic appears across Linux, wireguard-go, wireguard-nt, FreeBSD, and OpenBSD implementations.

5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected

A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.

Building Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager

The article explains how to establish verifiable TLS across a Kubernetes cluster running on Talos with Cilium networking and Linstor storage, eliminating reliance on InsecureSkipVerify flags. It details the creation of an internal self-signed CA via cert-manager, using a selfSigned bootstrap issuer to generate the CA certificate before deploying a production ClusterIssuer. trust-manager then distributes only the public CA bundle as ConfigMaps across all namespaces, allowing workloads to validate certificates without exposing private keys. For external services, an ACME issuer integrates with Let's Encrypt and Gateway API to automate HTTP-01 challenges. The guide also covers kubelet server certificate rotation through serverTLSBootstrap and the kubelet-serving-cert-approver controller, which validates CSR requests against Node objects before approval. These steps ensure mutual trust for internal services, publicly trusted certificates for internet-facing endpoints, and verified kubelet connections for the API server and monitoring systems.

Securing CI/CD in Open Source Projects: Cilium’s Final Guide to Credentials, Verification, and Remaining Gaps

VK Cloud has published the third and final part of its translated Cilium series on protecting the software supply chain in open source projects. The article details how Cilium isolates CI and production credentials using separate GitHub environments, enforces keyless signing with Sigstore Cosign and SBOM attestations, and applies strict release controls that prevent compromised workflows from reaching production images. It also covers the team’s ongoing security operations, additional hardening measures such as immutable tags and mandatory DCO sign-offs, and a gap analysis against OpenSSF Scorecard and SLSA standards. The post examines GitHub’s 2026 Actions security roadmap and explains how planned platform features like dependency blocking, scoped secrets, and native egress firewalls align with Cilium’s existing controls. The piece concludes by emphasizing defense-in-depth and the importance of openly sharing supply-chain security practices across the open source community.