14 posts with tag #security

Blocking ~160 known AI-crawler user agents at an Istio ingress gateway without Lua: why AuthorizationPolicy cannot do substring header matching, and why a single safe_regex alternation would silently never match anyway.

ingress-nginx is retired, not retiring — the GitHub repo was archived in March 2026. What changed, the CVEs disclosed since, and four honest ways forward.

Two Istio/Envoy pitfalls: AuthorizationPolicy IP matching (direct_remote_ip vs. remote_ip) and HTTP/2 connection coalescing across per-hostname listeners.

NIS2, DORA, PCI-DSS, HIPAA, and CRA controls mapped to Kubernetes configuration — audit logging, log retention, and incident reporting. Part 7 of 7.

RBAC, Pod Security Admission, NetworkPolicy, and supply-chain controls — the security practices every Kubernetes production workload needs. Part 5 of 7.

Container image hygiene, health probes, graceful shutdown, and securityContext — what every workload running in Kubernetes has to get right. Part 2 of 7.

Application security: SQL Injection, Log4Shell, OWASP Top 10, and Input Validation — attacks that affect confidentiality and integrity, not availability.

Technical (D)DoS attack vectors: Layer 3/4 floods, BGP hijacking, Layer 7 application DDoS, and operational resilience strategies to keep services available.

Non-technical (D)DoS overview: how denial-of-service attacks operate at the Business, Social, and Informational level, and what protection looks like at each.

Index for a three-part (D)DoS and Application Security series: business, social, and technical denial-of-service, plus SQL Injection, Log4Shell, and OWASP risks.