One of the wild things about #Kubernetes is the variation in configurations between distributions.

An odd one is that microk8s from Canonical, doesn't enable RBAC out of the box.

Even if you read their "getting started" tutorial, there's no mention of enabling it in the "important addons" section https://ubuntu.com/tutorials/install-a-local-kubernetes-with-microk8s#3-enable-addons !!

Now they did disable anonymous access by default, so no unauthenticated RCE, but it does mean that any workload deployed to the cluster gets automatic cluster-admin rights .... which is not great for a distribution billed as "the go-to platform for mission-critical workloads"

So, some time ago I was playing with the idea of adding tracking to container images (https://raesene.github.io/blog/2023/02/11/Fun-with-Containers-adding-tracking-to-your-images/) .

the idea is that you add a URL to the config section of an OCI image and then whenever the image gets pulled, the URL gets called.

I can't remember exactly where I uploaded the image with the canary token in it, but someone's been pulling that image regularly for a while now and I get a ping whenever they do :)

We've got a new blog out looking at #Kubernetes versions in use in real-world clusters, and it's actually quite good news from a security perspective.

With the addition of extended support for the major managed Kubernetes distributions, it looks like most of the cluster's were seeing are running on supported versions. That's quite an improvement over the last couple of years.

https://securitylabs.datadoghq.com/articles/a-2025-look-at-real-world-kubernetes-adoption/

Three high severity CVEs in runc announced today https://seclists.org/oss-sec/2025/q4/138, which present a risk of container escape, worth making sure you're patching!

It's not necessarily widely known but runc is a core component in most Kubernetes clusters. Often times you don't install it directly but get it as part of other packages like containerd, but it is there launching all the containers in your cluster.

From a first read through of the advisories, one quote that particularly resonated with me :-

"it is very difficult, if not impossible, to run an untrusted program with root privileges safely."

It's been good advice for a long time to run containers as a non-root user and even where the container needs to run as root, with user namespace support available in Kubernetes, it's a lot easier to avoid the risks of running containers as the host root user!