Essays on AIOps, cloud-native infrastructure, and how systems behave at scale.https://ashishrpandey.com/https://ashishrpandey.com/blog/kubernetes-security-config-paths/https://ashishrpandey.com/blog/kubernetes-security-config-paths/A map of the files and objects you will open when Trivy, Falco, PSS, AppArmor, and the API server are misbehaving.Mon, 07 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/runtime-detection-with-falco/https://ashishrpandey.com/blog/runtime-detection-with-falco/Falco sits on syscalls and Kubernetes audit events. Custom rules go in falco_rules.local.yaml. Restart, then prove the rule fires.Sun, 06 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/gvisor-kata-kube-bench/https://ashishrpandey.com/blog/gvisor-kata-kube-bench/RuntimeClass to pick gVisor or Kata for a workload, and kube-bench to score the node against CIS Kubernetes.Sat, 05 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/apparmor-and-seccomp/https://ashishrpandey.com/blog/apparmor-and-seccomp/Kernel-level restrictions for pods: load an AppArmor profile on the node, point seccomp at RuntimeDefault or a localhost JSON, then test the deny.Fri, 04 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/pod-security-and-gatekeeper/https://ashishrpandey.com/blog/pod-security-and-gatekeeper/Namespace labels for PSS, what restricted actually requires, and how Gatekeeper ConstraintTemplates sit on top of admission.Thu, 03 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/imagepolicywebhook/https://ashishrpandey.com/blog/imagepolicywebhook/How ImagePolicyWebhook actually gets wired: kube-apiserver flags, admission config, kubeconfig, and why defaultAllow: false is the whole point.Wed, 02 Sep 2026 00:00:00 GMThttps://ashishrpandey.com/blog/scan-images-with-trivy/https://ashishrpandey.com/blog/scan-images-with-trivy/A working Trivy workflow: severity filters, ignore files, Kubernetes scans, and exit codes you can put in a pipeline.Tue, 01 Sep 2026 00:00:00 GMT