Ugo Giordano's contributions
Article
Why killing pods is not enough: Testing operator reconciliation with operator-chaos
This article discusses operator-chaos, an open source chaos engineering framework for Kubernetes operators. It explains why traditional chaos tools miss operator failures, introduces the four injection modes provided by operator-chaos, and demonstrates its use against cert-manager on a live cluster. The article also highlights the importance of testing operator reconciliation logic beyond just pod restarts.
Article
Why your RBAC linter misses privilege escalation chains (and how to fix it)
Learn how to detect and prevent privilege escalation in Kubernetes RBAC through binding chains with kube-chainsaw, a tool that builds permission graphs from static manifests.
Article
5 anti-patterns that cause Kubernetes operator vulnerabilities
Fix Kubernetes operator OOMKill issues by avoiding 5 common informer cache anti-patterns. Learn how to audit and optimize your controller-runtime Go code.
Article
Protect your Kubernetes Operator from OOMKill
Prevent OOM crashes in controller-runtime operators. Learn how to filter your Kubernetes informer cache to stop ConfigMap-driven denial-of-service attacks.
Why killing pods is not enough: Testing operator reconciliation with operator-chaos
This article discusses operator-chaos, an open source chaos engineering framework for Kubernetes operators. It explains why traditional chaos tools miss operator failures, introduces the four injection modes provided by operator-chaos, and demonstrates its use against cert-manager on a live cluster. The article also highlights the importance of testing operator reconciliation logic beyond just pod restarts.
Why your RBAC linter misses privilege escalation chains (and how to fix it)
Learn how to detect and prevent privilege escalation in Kubernetes RBAC through binding chains with kube-chainsaw, a tool that builds permission graphs from static manifests.
5 anti-patterns that cause Kubernetes operator vulnerabilities
Fix Kubernetes operator OOMKill issues by avoiding 5 common informer cache anti-patterns. Learn how to audit and optimize your controller-runtime Go code.
Protect your Kubernetes Operator from OOMKill
Prevent OOM crashes in controller-runtime operators. Learn how to filter your Kubernetes informer cache to stop ConfigMap-driven denial-of-service attacks.
