I’ve been using Trivy for a while as a security quality gate for container security. More recently been looking at their Kubernetes cluster scanning offering — the Trivy Operator. From the docs: The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised…

When you are installing packages into a Kubernetes cluster, the go-to solution for software writers is to provide a Helm chart with a default values.yaml file to allow you to easily deploy all of the required resources for their application with a few commands. You will normally see something like…

If you use Terraform for managing your infrastructure as code, it is important to know when the current state of your infrastructure is different to the infrastructure you have specified in your repository. Here is Hashicorp’s article on Terraform drift to explain in more detail: https://www.hashicorp.com/blog/detecting-and-managing-drift-with-terraform In this article I’m…

In a previous article, I covered how to deploy Cloudflare Zero Trust in Kubernetes (Using Cloudflare Zero Trust to acess your private resources) In this article we’re going to be covering how to setup Prometheus metrics and some monitors so we can be alerted if the health of our Cloudflared…

In a previous article, I covered the process for installing Falco in Kubernetes using Helm (Falco in Kubernetes with Alertmanager notifications). Now that I have been running Falco for a few weeks, I have found a few recurring cases where I want to make some customisations/exceptions to the out of…

If you’ve been following my articles, I have recently set up a homelab of 3 Kubernetes nodes while training for my CKA/CKS certifications (Setting up homelab 3.0, Installing a bare-metal Kubernetes cluster with Ansible). Now that my cluster is running I’ve been focussing on the security aspect of managing a…

In this article I’ll be covering how to configure Cloudflare Zero Trust to access your private network without opening up any external firewall ports. We’ll be deploying a Cloudflare tunnel agent into Kubernetes as a means of accessing resources on your private network via Cloudflare. In this article I won’t…

In this article I’m going to be covering how to monitor the Application health of your ArgoCD implementation with Prometheus. Monitoring the health of your Applications is important to understand when your applications have not synced correctly from your source (eg git) or when an application state becomes unhealthy or…

In this article I’ll be describing how I setup a free “dead man’s switch” for Prometheus using the free tier support from https://healthchecks.io/ to “monitor the monitor” and ensure my Prometheus cluster is online and functioning correctly. We’ll be using a few tools to do this: Prometheus/Alertmanager Kubernetes secrets healthchecks.io What is a dead man’s switch? …