kubernetes
Where Kubernetes security config actually lives
A map of the files and objects you will open when Trivy, Falco, PSS, AppArmor, and the API server are misbehaving.
Watch the cluster at runtime with Falco
Falco sits on syscalls and Kubernetes audit events. Custom rules go in falco_rules.local.yaml. Restart, then prove the rule fires.
Sandbox runtimes and CIS checks: gVisor, Kata, kube-bench
RuntimeClass to pick gVisor or Kata for a workload, and kube-bench to score the node against CIS Kubernetes.
AppArmor and seccomp on Kubernetes
Kernel-level restrictions for pods: load an AppArmor profile on the node, point seccomp at RuntimeDefault or a localhost JSON, then test the deny.
Pod Security Standards and Gatekeeper
Namespace labels for PSS, what restricted actually requires, and how Gatekeeper ConstraintTemplates sit on top of admission.
Stop untrusted images at the API with ImagePolicyWebhook
How ImagePolicyWebhook actually gets wired: kube-apiserver flags, admission config, kubeconfig, and why defaultAllow: false is the whole point.
Scan images and clusters with Trivy
A working Trivy workflow: severity filters, ignore files, Kubernetes scans, and exit codes you can put in a pipeline.