https://dileepkumar.dev/tags/security/ Recent content in security on Dileep Kumar https://dileepkumar.dev/papermod-cover.png https://dileepkumar.dev/papermod-cover.png Hugo -- gohugo.io en Fri, 15 May 2026 03:52:00 +0530 https://dileepkumar.dev/post/vault-approle-auth-method/ Fri, 15 May 2026 03:52:00 +0530 https://dileepkumar.dev/post/vault-approle-auth-method/ Complete guide to using Vault AppRole authentication with Kubernetes — ideal for external Vault servers, CI/CD pipelines, and scenarios where K8s API is unreachable from Vault. https://dileepkumar.dev/post/vault-kubernetes-auth-method/ Fri, 15 May 2026 03:51:00 +0530 https://dileepkumar.dev/post/vault-kubernetes-auth-method/ Step-by-step guide to configuring the Kubernetes auth method in HashiCorp Vault — covering internal and external Vault topologies, service account setup, RBAC, policies, and production hardening. https://dileepkumar.dev/post/vault-kubernetes-integration-guide/ Fri, 15 May 2026 03:50:00 +0530 https://dileepkumar.dev/post/vault-kubernetes-integration-guide/ Master Vault + Kubernetes integration — covering every auth method, secret injection pattern, deployment topology, and GitOps workflow with step-by-step implementation guides. https://dileepkumar.dev/post/shai-hulud-worm-teampcp-supply-chain-attack/ Fri, 15 May 2026 03:30:00 +0530 https://dileepkumar.dev/post/shai-hulud-worm-teampcp-supply-chain-attack/ If you work anywhere near open-source infrastructure, CI/CD pipelines, or cloud-native tooling, you need to know about the Mini Shai-Hulud worm. Named after the colossal sandworms of Frank Herbert’s Dune, this self-propagating malware—deployed by the threat actor group TeamPCP—burrowed through the npm and PyPI ecosystems in May 2026, compromising hundreds of packages and turning trusted developer tooling into a weapon. This is not a theoretical supply chain risk. This is one of the most sophisticated attacks the open-source ecosystem has ever faced. https://dileepkumar.dev/post/docker-configuration-and-security/ Tue, 14 Jan 2025 00:07:00 +0530 https://dileepkumar.dev/post/docker-configuration-and-security/ Introduction Properly configuring Docker is essential for both security and functionality, especially in enterprise and production environments. This comprehensive guide covers critical configuration scenarios, security hardening techniques, and best practices for running Docker safely in production. We’ll explore proxy configuration, registry trust management, security scanning, resource limits, and the principle of least privilege—all essential for production-ready Docker deployments. Part 1: Configuring Docker for Corporate Networks Understanding the Proxy Challenge In corporate environments, direct internet access is often restricted. https://dileepkumar.dev/post/dockerfile-best-practices/ Tue, 14 Jan 2025 00:06:00 +0530 https://dileepkumar.dev/post/dockerfile-best-practices/ Introduction A Dockerfile is the blueprint for building Docker images. It’s a text file containing a series of instructions that Docker reads from top to bottom to assemble an image. Understanding how to write efficient, secure, and maintainable Dockerfiles is fundamental to mastering Docker. This comprehensive guide takes you from Dockerfile basics to advanced optimization techniques, covering every instruction, when to use it, and best practices for production-ready images. https://dileepkumar.dev/post/docker-registry-setup-and-management/ Tue, 14 Jan 2025 00:04:00 +0530 https://dileepkumar.dev/post/docker-registry-setup-and-management/ Introduction While Docker Hub is excellent for public images, production environments require private registries for proprietary applications. A private Docker registry gives you complete control over your container images, their storage location, access permissions, and distribution. This comprehensive guide covers everything from running a basic local registry to implementing production-grade solutions with authentication, TLS encryption, and high availability. Why Run a Private Docker Registry? Security and Compliance: Keep proprietary code and sensitive applications off public registries Meet regulatory requirements for data sovereignty Control who can access your images with fine-grained permissions Scan images for vulnerabilities before deployment Performance and Reliability: https://dileepkumar.dev/post/kubernetes-configuration-management/ Sun, 12 Jan 2025 23:45:00 +0530 https://dileepkumar.dev/post/kubernetes-configuration-management/ Introduction Hardcoding configuration values and sensitive data directly into your application code is a recipe for disaster. It makes your applications inflexible, insecure, and difficult to manage across different environments. Kubernetes provides two powerful objects to solve this problem: ConfigMaps for configuration data and Secrets for sensitive information. In this comprehensive guide, I’ll show you how to effectively manage application configuration and secrets in Kubernetes, following security best practices and production patterns.