Security on marktaguiad.dev

Kubernetes Sealed Secrets

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sun, 19 Apr 2026 00:00:00 +0000

k8s-sealed-secrets.png Managing secrets in Kubernetes is a bit tricky. Native Secret objects are only base64-encoded—not encrypted—making them unsafe for Git-based workflows. If you’re doing GitOps (e.g., with Argo CD), committing raw secrets is not an option.

This is where Sealed Secrets comes in.

Why Sealed Secret?

Sealed Secrets uses asymmetric encryption to solve one problem:

Kubernetes RBAC

marktaguiad@marktaguiad.dev (Mark Taguiad) — Tue, 07 Apr 2026 00:00:00 +0000

Role‑Based Access Control (RBAC) is a core part of Kubernetes security — it lets you grant precise permissions to users, groups, or service accounts so they can do only what they’re allowed. In this hands‑on guide, we’ll go step‑by‑step through:

creating a Kubernetes user
assigning permissions using RBAC
testing permissions

Create Kubernetes User

Let’s automate this process-in the perspective of an admin. Use the script to create user.

Istio: Fault Injection, Retries and Circuit Breaker

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sat, 28 Mar 2026 00:00:00 +0000

Continuation of Kubernetes Istio.

I’ve mentioned in this post that will sticking with HTTPRoute, but feature discussed here only support (for now) Istio API.

Ingress Gateway

Istio deploys a default resource for this, and for this example we are using the default ingress gateway ingressgateway.

If you want to create a custom ingress gateway.

istio-gateway.yaml

 1apiVersion: install.istio.io/v1alpha1
 2kind: IstioOperator
 3metadata:
 4  name: istio-control-plane
 5  namespace: istio-system
 6spec:
 7  components:
 8    ingressGateways:
 9      - name: istio-ingressgateway-prod
10        namespace: istio-system
11        enabled: true
12        label:
13          istio: ingressgateway-prod
14
15      - name: istio-ingressgateway-dev
16        namespace: istio-system
17        enabled: true
18        label:
19          istio: ingressgateway-dev

This will create two ingress gateway.

Istio: mTLS and RBAC

marktaguiad@marktaguiad.dev (Mark Taguiad) — Tue, 24 Mar 2026 00:00:00 +0000

Continuation of Kubernetes Istio, this time we’ll focus on Security.

Security

mTLS (Mutual TLS)

This will ensure that service-to-service traffic is encrypted and authenticated.

Istio allows you to configure three main modes per namespace, workload, or globally:

Mode	Behavior	When to Use
STRICT	Only allows mTLS-encrypted traffic. Plain HTTP connections are rejected.	Best for production when you want full security between services.
PERMISSIVE	Accepts both mTLS-encrypted and plain HTTP traffic.	Useful during gradual migration to mTLS. Old workloads can still communicate without encryption.
DISABLE	Does not use mTLS at all.	For testing, legacy workloads, or non-critical traffic.

You might get confused with the HTTPS traffic, it just mean that all traffic are converted by istio envoy to mTLS. So as long as the request is going through first the sidecar then it is valid.

Linux Security & Hardening

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sat, 26 Jul 2025 00:00:00 +0000

Info

Content here are automated using ansible, check here if you are interested.

SSH hardening

SSH is one of the most targeted services on any server exposed to a network. Hardening SSH reduces the attack surface, limits brute-force attempts, and enforces stronger authentication and cryptography.

Security on marktaguiad.dev

Kubernetes Sealed Secrets

Table of Contents

Why Sealed Secret?

Kubernetes RBAC

Table of Contents

Create Kubernetes User

Istio: Fault Injection, Retries and Circuit Breaker

Table of Contents

Ingress Gateway

Istio: mTLS and RBAC

Table of Contents

Security

mTLS (Mutual TLS)

Linux Security & Hardening

Table of Contents

SSH hardening