Inspektor Gadget is a framework and toolkit that uses eBPF to collect and inspect data on Kubernetes clusters and Linux hosts. It manages the packaging, deployment, and execution of “gadgets” — eBPF programs packaged as OCI images. OCI (the Open Container Initiative) is a Linux Foundation project that defines open industry standards for container image formats and runtimes, so the same image can be distributed and run across any compliant tool or registry. For teams running Kubernetes in production that need to understand what is happening inside a cluster, Inspektor Gadget provides that visib
Inspektor Gadget: Results from the first security audit… To use a real LLM: Get an API key from OpenAI, Anthropic, or Gemini Create a Kubernetes secret with your key Update the AgentgatewayBackend to use the real host and authentication yaml apiVersion: gateway.kgateway.dev/v1alpha1 kind: Backend metadata: name: openai namespace: kgateway-system spec: ty… …
… They identified six bypass scenarios, ranging from using newer Linux syscalls that certain gadgets don’t hook for example, openat2 instead of openat to evasion through io uring and statically linked libraries. …
… Here’s the relevant portion of the Collector config the full file is downloadable alongside this post : receivers: prometheus/mesh: config: scrape configs: - job name: linkerd-mesh scrape interval: 30s kubernetes sd configs: - role: pod relabel configs: - source labels: meta kubernetes pod containe… …
… References Kubernetes repository: https://github.com/kubernetes/kubernetes k0s repository: https://github.com/k0sproject/k0s k0rdent repository: https://github.com/k0rdent/k0rdent k0smotron repository: https://github.com/k0sproject/k0smotron Cilium repository: https://github.com/cilium/cilium Dynam…
… The remote attestation process verifies the initdata . This ensures any modification to the initdata by the Kubernetes control plane is detected by the App Security team. Conditional Secret Delivery: Any required credential or key is delivered only after successful attestation. …
… The cloud-config model lets us define node behaviour, SSH keys, network configuration, SSSD authentication against our Active Directory, Kubernetes agent registration, all as versioned YAML that flows through FluxCD just like any other platform component. …
… The distribution layer needs to keep up. Now it can. Pavan Madduri is a Senior Cloud Platform Engineer at W.W. Grainger and a CNCF Golden Kubestronaut. He specializes in architecting massive, self-healing multi-cloud infrastructure and pioneering ‘Agentic Ops’ for enterprise Kubernetes environments. …
… NetFUNNEL Virtual Waiting Room and BotManager bot mitigation serve millions of concurrent users across 200 countries. Questions? grace@stclab.com | stclab.com
… Configuration-Only Telemetry Export Trace export is managed entirely via Kubernetes configuration. Operators can configure exporters, credentials, and routing parameters without application code changes. …