pod-security-standards

Kubernetes hardening baseline: tested Kyverno policies, Pod Security Admission restricted namespace, default-deny NetworkPolicy with DNS and a hardened Deployment. Audit-first, kubeconform + kyverno test in CI. MIT.

A production-like local Kubernetes platform on kind — Cilium CNI, Pod Security Standards, RBAC, default-deny NetworkPolicies, cert-manager TLS, NGINX ingress, and Vault secrets via the External Secrets Operator.

Kubernetes security hardening: CIS Benchmark L1/L2 | Ansible | Falco eBPF runtime rules | RBAC audit | Pod Security Standards | kube-bench

Check Kubernetes manifests before they reach a cluster: Pod Security Standards, resource requests and limits, readiness probes, image tags and plain-text secrets, each tied to the Kubernetes docs. Zero dependencies.

Kubernetes hardening baseline: Pod Security Standards, NetworkPolicies, OPA Gatekeeper, Falco rules, Cosign verification. CIS-aligned.

Static security auditing for Kubernetes Pod specs — Pod Security Standards, user namespaces, and SecurityContext, entirely offline. CLI + GitHub Action.

Open mini-CNAPP: one graph from commit -> CI run -> image -> K8s pod -> runtime event. Checks Zero-Trust controls (Python + OPA/Rego) and traces Tetragon alerts through the verified Sigstore (cosign/Fulcio) certificate to the CI run, commit and failed control. Evaluated on real manifests, images and live kind clusters.

Browser-based Kubernetes manifest scanner. Checks Pod Security Standards, capabilities, image hygiene, probes, and service-account hardening.

Helm charts for the applications and utilities I run on Kubernetes, built on one shared library.