Anish Ramasekar

Kubernetes v1.36: Admission Policies That Can't Be Deleted

Mon, 04 May 2026 00:00:00 +0000

Kubernetes v1.36 introduces an alpha feature that addresses the challenge of enforcing security policies across cluster bootstrap: manifest-based admission control. It lets you define admission webhooks and CEL-based policies as files on disk, loaded by the API server at startup, before it serves any requests, ensuring they can’t be deleted or bypassed.

Kubernetes v1.35: A Better Way to Pass Service Account Tokens to CSI Drivers

Wed, 07 Jan 2026 00:00:00 +0000

Kubernetes v1.35 introduces a beta solution to address service account token handling in CSI drivers: CSI Driver Opt-in for Service Account Tokens via Secrets Field. This allows CSI drivers to receive service account tokens through the secrets field in NodePublishVolumeRequest, which is the appropriate place for sensitive data in the CSI specification.

Strengthening Kubernetes Trust: SIG Auth's Latest Security Enhancements

Wed, 12 Nov 2025 00:00:00 +0000

SIG Auth is leading efforts to strengthen Kubernetes’ authentication and authorization foundations. This session covers recent and upcoming features shaping security across the stack, including secure image pulls using ephemeral ServiceAccount tokens, new mechanisms for provisioning X.509 certificates to pods, hardened kubelet serving certificate validation, and improvements in authorization policies.

Kubernetes v1.34: Service Account Token Integration for Image Pulls Graduates to Beta

Wed, 03 Sep 2025 00:00:00 +0000

Service Account Token Integration for Kubelet Credential Providers graduates to beta in Kubernetes v1.34, bringing enhanced security for image pulls.

Externalizing Secrets Securely in Kubernetes with Secrets Store CSI Driver

Tue, 02 Sep 2025 00:00:00 +0000

Storing secrets in Kubernetes via native Secret objects has long been standard practice - but evolving security and compliance requirements demand more secure approaches. In this episode, we introduce the Secrets Store CSI Driver, a Kubernetes SIG Auth subproject that securely integrates your workloads with external secret stores like Azure Key Vault, Google Secret Manager, and AWS Secrets Manager. The CSI Driver mounts secrets directly into your pods at runtime, enabling zero-touch rotation and significantly reducing the risk of secret exposure or compromise. Join Anish and Ben as they demonstrate how to use the Secrets Store CSI Driver to meet modern security and compliance needs while simplifying secret management in Kubernetes.

JWT it like it's hot: A practical guide for Kubernetes Structured Authentication

Thu, 08 May 2025 00:00:00 +0000

A comprehensive guide to implementing Kubernetes Structured Authentication with practical examples using Microsoft Entra ID and Okta as JWT providers, featuring CEL-based validation and hot-reloading configuration.

Kubernetes v1.33: From Secrets to Service Accounts: Kubernetes Image Pulls Evolved

Wed, 07 May 2025 00:00:00 +0000

Exploring the evolution of Kubernetes image pulls with workload identity for enhanced security in v1.33. This post covers the new features that improve how Kubernetes handles image registry authentication.

Pushing Authorization Further: CEL, Selectors and Maybe RBAC++

Fri, 15 Nov 2024 00:00:00 +0000

Explore advanced authorization patterns in Kubernetes, including CEL expressions, advanced selectors, and potential future enhancements to RBAC. Learn how to implement fine-grained access control.

Rogue No More: Securing Kubernetes with Node-Specific Restrictions

Fri, 15 Nov 2024 00:00:00 +0000

Learn how to implement node-specific restrictions in Kubernetes to prevent rogue nodes and enhance cluster security. This talk covers practical strategies and tools for securing Kubernetes nodes.

CEL-Ebrating Simplicity: Mastering Kubernetes Policy Enforcement

Wed, 13 Nov 2024 00:00:00 +0000

Exploring the Common Expression Language (CEL) and its application in Kubernetes policy enforcement. Learn how CEL simplifies policy creation and management while maintaining security and compliance.

SIG Auth & SIG Storage: Secret Guardians - (Secrets Store) CSI Driver and Sync Controller

Tue, 12 Nov 2024 00:00:00 +0000

In this lightning talk, Anish will introduce you to the (Secrets Store) CSI driver and Sync controller and discuss trade-offs of the CSI driver versus Sync controller.

Kubernetes 1.30: Structured Authentication Configuration Moves to Beta

Thu, 25 Apr 2024 00:00:00 +0000

Deep dive into the structured authentication configuration feature and its beta graduation in Kubernetes 1.30. Learn about the new capabilities and how to leverage them for enhanced security.

Secrets Management - Feat. ESO, SSCSID, Teller, and SOPS (You Choose!, Ch. 3, Ep. 3)

Tue, 23 Jan 2024 00:00:00 +0000

Comparative analysis of popular secrets management tools including External Secrets Operator (ESO), Secrets Store CSI Driver (SSCSID), Teller, and SOPS. Learn which tool fits your use case best.

OIDC and Workload Identity in Kubernetes

Thu, 09 Nov 2023 00:00:00 +0000

Deep dive into OpenID Connect (OIDC) and Workload Identity in Kubernetes. Exploring how to securely authenticate workloads and manage identity across cloud-native applications.

Keeping Secrets Secret: Secrets Store CSI Driver

Thu, 03 Aug 2023 00:00:00 +0000

Live presentation on the Secrets Store CSI Driver, covering its design principles, implementation details, and real-world usage patterns for keeping secrets secure in Kubernetes.

Kubernetes 1.27: KMS V2 Moves to Beta

Tue, 16 May 2023 00:00:00 +0000

Announcing the graduation of KMS V2 to beta status in Kubernetes 1.27 and what this means for Kubernetes encryption. Learn about the new capabilities and stability improvements.

Kubernetes 1.25: KMS V2 Improvements

Fri, 09 Sep 2022 00:00:00 +0000

Exploring the enhancements and improvements in KMS V2 for better encryption key management in Kubernetes 1.25. This post covers the new features, performance improvements, and migration guidance.

Advancements in Kubernetes Workload Identity for Azure

Tue, 31 May 2022 00:00:00 +0000

Explore the latest advancements in Kubernetes Workload Identity for Azure environments. Learn about new features, security improvements, and integration patterns for cloud-native applications.

Secrets Store CSI Driver: Bringing external secrets in house

Wed, 09 Mar 2022 00:00:00 +0000

CNCF webinar demonstrating how the Secrets Store CSI Driver enables secure integration of external secret stores with Kubernetes workloads. Covers architecture, implementation, and best practices.

Azure Upstream - Ep. 1 - Workload Identity - Part 1

Fri, 28 Jan 2022 00:00:00 +0000

In this first episode from the Azure Upstream open-source team, Ernest Wong and I discuss the origins of Azure AD Pod Identity, its limitations, and introduce the newer Azure Workload Identity project with live demos.

Azure Upstream - Ep. 1 - Workload Identity - Part 2

Fri, 28 Jan 2022 00:00:00 +0000

In this second episode, Ernest Wong and I dive deeper into Azure Workload Identity with detailed configuration demos and best practices for assigning Azure identities to Kubernetes pods.

Announcing Azure Active Directory (Azure AD) workload identity for Kubernetes

Tue, 18 Jan 2022 00:00:00 +0000

Introduction of Azure AD workload identity for Kubernetes - a new authentication mechanism that enables Kubernetes workloads to access Azure resources using Azure Active Directory without storing secrets in the cluster.

Secrets Store CSI Driver: Keeping Secrets Secret

Fri, 14 May 2021 00:00:00 +0000

Learn about the Secrets Store CSI Driver and how it enables seamless integration between Kubernetes and external secret management systems like Azure Key Vault, AWS Secrets Manager, and HashiCorp Vault.

Achievement: This talk was ranked in the top 10 at KubeCon EU 2021 according to the CNCF Transparency Report.

The Secrets Store CSI Driver represents a paradigm shift in how Kubernetes applications consume secrets from external systems. This talk introduces the driver’s architecture, demonstrates its capabilities, and shows how it addresses common security challenges in cloud-native environments.