Tag: Kubernetes
All the articles with the tag "Kubernetes".
Falco in Kubernetes: syscall-level runtime protection, unified with Wazuh SIEM (part 6/6)
The finale of the Wazuh series: installing Falco in the cluster — the CNCF graduated project that intercepts syscalls from every container on a node. eBPF driver vs kernel module, the rule format, custom detects for shells and host-directory mounts, falcosidekick as the alert bus, and one dashboard for hosts, control plane, and runtime.
Wazuh and Kubernetes: collecting cluster audit logs and seeing who does what (part 5/6)
Part 5 of the Wazuh series: taking the SIEM beyond individual hosts and into Kubernetes — audit policy and its levels, shipping logs with Fluent Bit, a decoder for audit JSON, and rules for exec, secrets reads, and privileged pods mapped to MITRE ATT&CK for Containers.
Cilium Tetragon: eBPF runtime security that blocks, not just logs
Falco and most eBPF security tools can only alert after the fact. Tetragon, Cilium's runtime security engine, can do more — kill a process synchronously in the kernel before the syscall even returns. We break down the TracingPolicy anatomy, enforcement risks, and the safe rollout pattern: audit first, Sigkill later.
containerd 1.x is done: what breaks moving to containerd 2.0 before Kubernetes 1.36
Kubernetes 1.35 is the last release that still supports containerd 1.x. We break down what actually changes in config.toml v3, the CRI plugin, and CDI for GPUs, and how to roll containerd 2.0 out node by node with zero downtime.