Kubernetes

RWB Infra x Security Meetup Shares Recordings on GitLab Scaling, Kubernetes Bare Metal, Vault PKI and DevSecOps Platforms

On October 3 in Moscow, RWB held the Infra x Security Meetup that combined infrastructure and information security tracks. Infrastructure speakers covered scaling GitLab CE under growing load, trade-offs in developing the DCIM data center management product, building centralized PKI with Vault, and operational challenges of running Kubernetes on bare metal servers. Security speakers discussed scaling DevSecOps from pipeline scanning to an ASPM platform, vulnerability management tools that reduced remediation time, protecting data without a single perimeter using Identity × Data × Context × Policy, and automating access control across one thousand systems in under 90 seconds. All presentations were recorded and the videos plus slides are now publicly available on YouTube and VK. The event highlighted practical engineering decisions made by RWB teams while operating large-scale internal platforms.

Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments

Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.

Yandex Cloud Cascade Failure October 2026 Exposes Multi-AZ Limits and Capacity Exhaustion Risks

In October 2026, Yandex Cloud suffered a prolonged cascade outage across multiple data centers in Sасово, Калуга, and Владимир, triggered by power failures and a drone-related fire that fully disabled the ru-central1-b zone. The incident revealed that standard Multi-AZ designs reach physical capacity exhaustion when multiple zones fail simultaneously, leaving insufficient resources in remaining zones for automatic failover. Businesses relying on managed Kubernetes, databases, and SaaS platforms such as Salebot and CIAN experienced extended recovery times, with backups becoming inaccessible and RTO stretching beyond 24 hours due to index rebuilds and manual quota allocation. Yandex Cloud responded by manually distributing quotas, partnering with Selectel, K2Cloud, and VK Cloud for emergency capacity, and advising clients to activate external disaster recovery plans. The outage also highlighted single points of failure in DDoS protection configurations and Control Plane dependencies that prevented timely migration of master nodes. Architectural recommendations include deploying independent edge webhook buffers using FastAPI on separate VDS instances to preserve incoming events during primary backend failures. Overall, the events underscore the necessity of true multi-cloud strategies that avoid reliance on any single provider's IAM, billing, and physical infrastructure.

PKI Storm: Managing 100,000 Simultaneous Certificate Requests in Kubernetes Recovery Scenarios

A large organization's PKI infrastructure faced a critical bottleneck when a data center outage triggered simultaneous startup of tens of thousands of Kubernetes pods, each requiring mTLS certificates. The existing setup using ESAUS and Citadel routed all requests through external certificate authorities that could only sustain 50-70 RPS against an incoming burst of 100,000 requests. Average daily load of 10-11 RPS had masked the thundering herd risk during mass recovery. Scaling the CA 15x was rejected due to cost and the fundamental dependency on real-time signing. The team introduced pre-issuance of certificates stored in a dedicated Unified Secret Storage (ЕХС) layer that supports 14,000 RPS reads while the CA continues normal operation. This architectural separation of issuance and consumption reduced recovery time from nearly 24 minutes to seconds while shifting focus to secure secret lifecycle management including KRA key protection.

Dell Patches Six Critical Flaws in Container Storage Modules for Kubernetes

Dell has fixed six vulnerabilities in its Container Storage Modules that integrate storage systems with Kubernetes clusters. Two of the issues received the maximum CVSS score of 10.0, allowing remote unauthenticated attackers to obtain full administrative credentials for registered storage backends. Additional flaws enable privilege escalation to root on cluster nodes, exposure of hardcoded credentials, and leakage of Kubernetes secrets across the entire cluster. All versions prior to 1.17.0 are affected, with the fixes delivered in version 1.18.0. No workarounds exist, and Dell recommends rotating JWT signing keys after applying the update because the previous keys must be considered compromised.

RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent

RWB has replaced fragmented manual database access processes with a centralized architecture built on Trino as the single entry point and Open Policy Agent for policy enforcement. The system enforces least-privilege access, mandatory auditing, and automated revocation tied to HR records while eliminating anonymous and password-based logins. Access requests now complete in 3–10 minutes instead of an average of four days, with 92 percent handled automatically. Key components include Keycloak for OIDC authentication, Vault for secrets, Kafka for security event streaming to SOC, and Kubernetes orchestration. Responsibility is split across AI & Data Security, Core DevOps, Access Management, SOC, and Trust & Safety teams. More than 1,250 PostgreSQL clusters and 90 projects are now connected, with real-time dashboards tracking adoption and policy health.

AI Accelerates DevSecOps but Expands Attack Surfaces Across Code, Supply Chains, and Runtime Environments

Experts from Solar, Luntry, and Hexway report that AI has shortened the vulnerability exploitation window from 63 days in 2019 to just hours in 2025. The shift toward third-party libraries and vibe coding has redirected attacker focus to supply-chain compromises affecting thousands of organizations. AI-generated code introduces unique risks because it often bypasses established libraries, testing phases, and security reviews, with 41% of confidential data leaks into LLMs now consisting of source code. While AI tools like the Solar appScreener plugin achieve over 90% accuracy in triage and 85% in code-fix recommendations, human verification remains mandatory for critical vulnerabilities. Platforms such as Hexway ASOC and Luntry extend protection into container orchestration and runtime monitoring to handle AI agents that make decisions during execution. The overall effect is a tenfold increase in AppSec team capacity, yet also a larger volume of findings that must be managed through integrated ASOC workflows.

EnvSpec Naming Standard Introduces Strict Six-Environment Hierarchy for Zero Trust Infrastructure

The EnvSpec Naming 1.0.0 standard proposes replacing ad-hoc hostnames with a strict hierarchical naming system based on environment, perimeter, system, slot and node. It defines exactly six environments—dev, test, stage, prod, infrastructure and workplace—and treats any test or pilot system processing real data as prod. The model projects names into SPIFFE IDs, Kubernetes namespaces, cloud projects and mandatory tags for automated policy enforcement. Rules prohibit direct communication between different linear environments and require all access from workplace devices through dedicated gateways. The standard is published under CC BY-SA 4.0 and includes machine-checkable criteria for compliance.

R-Vision VM 6.6 Adds Container Scanning, Web Application Audits and Mobile Scanner for Isolated Networks

R-Vision has released version 6.6 of its vulnerability management platform, expanding detection capabilities to web applications, Docker and Kubernetes container environments, and previously unreachable isolated network segments. The new web audit feature inventories resources and identifies associated vulnerabilities, although the company describes the current functionality as basic and not intended to replace dedicated DAST solutions. Container auditing now covers both Docker and Kubernetes, including runtime analysis, with findings presented directly in the host card within the central console. The most notable addition is a mobile scanner that runs on a laptop without requiring dedicated servers, allowing security specialists to audit air-gapped or remote sites and later upload results to the main R-Vision VM instance. The mobile component supports White Box, Black Box, Compliance and web-audit modes, performs full inventory, and is designed to scan up to 2000 hosts. Additional improvements include expanded inventory for ESXi, vCenter and network equipment, updated compliance checks, enhanced dashboards, automation policies and data export options, plus the ability to update agents directly from the interface.

Password Deleted from Git but Still Present: Major CI/CD Security Mistakes

Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.

Shadow AI in CI/CD: Why AI Agents Must Be Modeled as Security Threats

A new analysis from the CNCF highlights the growing risks of Shadow AI within continuous integration and continuous deployment pipelines. The report argues that AI agents should be treated as potential threats rather than simple productivity tools. Starting from a developer's laptop and extending to Kubernetes clusters, these agents can introduce unauthorized access paths and data exposure risks. Security teams are urged to incorporate AI agent behavior into formal threat modeling exercises. The discussion emphasizes the need for visibility and control over autonomous AI components operating in production environments.

Avoiding a Leaky Kubernetes Audit Policy: Real-World Configuration Breakdown

Kubernetes Audit Policy is typically configured once during cluster setup and then left untouched for years while accumulating exceptions for new components. Over time the policy stops functioning as a security control and instead becomes an archaeological layer of outdated comments such as "# temporary, TODO remove" that date back three years or more. The author recently reviewed their own 580-line configuration file that had been assembled from multiple sources. Primary reference was the Kubernetes Threat Matrix, which explains why many rules are designed to detect security-relevant actions rather than simply reduce log noise. Examples include targeted monitoring of RBAC modifications and deletion of events. The article emphasizes the need for periodic full reviews instead of incremental patching to maintain effective detection coverage.

Avito Details Security Gates Implementation to Enforce Vulnerability Remediation Without Disrupting Developers

Alexander Trifanov, head of Application Security at Avito, shares a detailed case study on building security gates that block risky deployments while preserving developer experience. The approach relies on asynchronous scanning pipelines using SAST, SCA, secret detection, and YAML Security tools aggregated in ASOC or SOAR systems. Gates are placed at multiple lifecycle points including pre-receive hooks, CI/CD deployment stages, and manual unit-level overrides via a red-button mechanism. Strict false-positive management, deduplication, and emergency bypass controls are highlighted as essential for scalability across thousands of developers. The article covers pre-receive gating limited to ten-second scans, separate library update flows, and Kubernetes integration attempts with Kyverno. Avito reports that even unused red-button capabilities significantly improve SLA compliance without frequent enforcement actions.

InfotecsTech Builds Custom Kubernetes-Based Traffic Generator for NGFW RnD and Performance Testing

InfotecsTech developed an in-house traffic generator to support development and testing of its high-performance NGFW cluster in active-active mode. The team rejected commercial solutions from IXIA and Xinertel due to high cost, insufficient flexibility for complex NGFW functions, and geopolitical restrictions. The resulting platform runs on Kubernetes with a master node managing Registry, Discovery, and Crux components while worker nodes host containerized generators. Supported generators include Cisco TRex for throughput and connection testing, SIPp for VoIP scenarios, pyftpdlib-based FTP generator, Yandex Tank with Nginx for live TLS traffic, and Selenium-based legitimate clients against OWASP Juice Shop. Practical scenarios cover VoIP call storms, maximum concurrent connections, 400 Gbit/s UDP throughput, 5 million CPS, and IMIX traffic at 300 Gbit/s with packet loss analysis. The system integrates Camunda for full automation of test scenarios and device configuration.

Critical Vulnerability CVE-2026-8715 Discovered in HashiCorp Vault Secrets Operator

HashiCorp has disclosed a critical vulnerability in its Vault Secrets Operator product that affects the AppRole authentication mechanism introduced in version 1.3.0. The flaw, tracked as CVE-2026-8715, stems from insufficient path validation in the secretIDPath field, allowing authenticated Kubernetes users to read arbitrary files from Pod filesystems. With a CVSS v3.1 base score of 9.6, the issue is rated Critical and can lead to credential theft by exfiltrating secrets to attacker-controlled endpoints. Exploitation requires specific permissions to create or retrieve VaultAuth, VaultConnection, and VaultStaticSecret resources. HashiCorp recommends immediate migration to version 1.5.0, which removes the vulnerable secretIDPath field entirely.

5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected

A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.

GitLab Developer Account Leads to Full OpenStack Cloud Control via CI/CD Runner Misconfigurations

A penetration testing team demonstrated how a standard developer account in GitLab can be escalated to full administrative control over an OpenStack cloud environment through typical CI/CD misconfigurations. Starting with only GitLab credentials, the testers created a pipeline that executed arbitrary commands on a production Kubernetes runner named PROD-K8S-RUNNER01. Membership in the docker group allowed privilege escalation to root by mounting the host filesystem and adding an SSH key. From the compromised host, the team discovered a kubeconfig file granting extensive Kubernetes permissions including secret access, pod execution, and role bindings. This access enabled mounting a node filesystem to extract OpenStack cloud-config credentials. The resulting cloud account possessed broad roles across nova, cinder, neutron, and other services, effectively providing administrator-level control over virtual machines, networks, storage, and managed Kubernetes clusters.

OTUS Publishes Extensive Digest Covering Kubernetes, GitLab CI, DevSecOps and Infrastructure Reliability

OTUS has released a large-scale digest that compiles free lessons, practical articles and advanced courses focused on real-world infrastructure challenges. The collection addresses interconnected topics including Kubernetes container orchestration, GitLab CI pipeline automation, observability with OpenTelemetry, network troubleshooting, and DevSecOps practices. Readers can explore specific lessons on secrets management with Vault, load testing, RAID recovery, and kernel-level protections in Linux. The digest also features in-depth articles on Docker Compose configuration, CrowdSec migration, L2 network loops, and self-service deployment models. For experienced professionals, OTUS offers specialized courses on high-load systems, PostgreSQL administration, Linux kernel development, and advanced networking with BGP and OSPF.

GC Solar and SEG-T Launch Development of AI-Powered Security Email Gateway SEG-T to Counter Advanced Phishing Campaigns

GC Solar and co-founder of Secure-T Khariton Nikishkin have initiated the development of SEG-T, a new Security Email Gateway solution designed to protect corporate email systems using multi-agent AI. The project responds to the growing sophistication of phishing attacks that leverage ready-made toolkits, infrastructure, anti-bot mechanisms, and AI-generated content to create convincing messages at scale. Unlike traditional filters, SEG-T will analyze both technical indicators and semantic elements such as tone, manipulation tactics, attempts to build trust, instill fear, or create urgency. The system will block suspicious attachments including links, archives, PDFs, executables, and SVGs while focusing primarily on social engineering rather than relying on a built-in sandbox. SEG-T is planned for deployment across cloud, on-premises, and Kubernetes environments with rapid 15-minute setup times and will integrate with Solar webProxy and Solar Dozor for enhanced traffic inspection and data loss prevention. GC Solar holds a 49% stake in the project following its earlier acquisition of a controlling interest in Secure-T.