Trivy
Trivy Container Scanning: Scan Docker Images and Kubernetes Workloads in CI
Trivy (from Aqua Security) has rapidly become the most popular open-source container vulnerability scanner.
Kubernetes
Latest
Deployment
Progressive Delivery Testing: Argo Rollouts, Flagger & Canary Analysis Templates
Progressive delivery automatically routes a small percentage of traffic to a new version, analyzes metrics, and either advances the rollout or triggers an automatic rollback. The system replaces human judgment in the deployment pipeline — which means the testing focus shifts to validating that the automation itself is correctly configured. Progressive
Testing
Chaos Mesh Testing Guide: PodChaos, NetworkChaos & Kubernetes Fault Injection
Chaos Mesh is a Kubernetes-native chaos engineering platform. It injects failures — pod crashes, network delays, CPU stress, disk failures — directly into your cluster via Kubernetes CRDs, without modifying application code. The goal is to discover resilience failures before they happen in production. Why Chaos Engineering Your monitoring, alerting, and
Security
Mutual TLS Testing Guide: Client Certificates, Service Mesh & Istio mTLS
Mutual TLS (mTLS) requires both client and server to present certificates during the TLS handshake.
Testing
seccomp Profiles: Writing and Testing Syscall Filters for Containers
Every system call a container makes is an attack surface. seccomp (Secure Computing Mode) lets you define exactly which syscalls a container is allowed to make — and kill or log anything outside that list. The challenge is writing profiles that are tight enough to restrict attacker behavior but permissive enough
Testing
Pod Security Standards: Validating Kubernetes PSS with Policy Tests
Pod Security Standards (PSS) replaced PodSecurityPolicy (PSP) in Kubernetes 1.25.
Testing
Falco: Runtime Threat Detection Testing for Kubernetes Workloads
Runtime security is the last line of defense. If a container escapes, an attacker pivots laterally, or malware executes inside your cluster — Falco is what catches it. But Falco rules that go untested are rules that fail silently when it matters most. This guide covers how to write, validate, and
Testing
OPA/Gatekeeper Policy Testing: Unit Tests for Admission Control Rules
OPA Gatekeeper extends Kubernetes admission control with custom policies written in Rego.
Testing
AppArmor and SELinux: Testing Mandatory Access Control Policies
Mandatory Access Control (MAC) is what runs underneath discretionary permissions.
DevOps
Testing Flux GitOps Pipelines: From Kustomization Validation to E2E
Flux automates GitOps deployments, which means a broken Kustomization or HelmRelease can silently fail to reconcile — or worse, reconcile incorrectly — without anyone noticing until a production incident. This guide covers the full Flux testing stack: flux build for local manifest rendering, flux diff for live drift detection, envtest for controller
DevOps
ArgoCD Testing Strategies: Validate GitOps Deployments Before They Land
ArgoCD makes GitOps deployments feel effortless — until a bad sync silently rolls out a broken config to 40 namespaces via an ApplicationSet. This guide covers how to validate ArgoCD applications, ApplicationSets, and sync policies before they reach a production cluster, using argocd app diff, local kind/k3d clusters, and automated
DevOps
Testing Crossplane Compositions: Validate Infrastructure Claims Before Applying
Crossplane Compositions are Kubernetes-native infrastructure templates that expand a simple XR claim into tens of managed resources. A bug in a Composition can delete a production RDS instance when someone creates a new database claim. This guide covers how to test Composition logic with crossplane beta render, unit-test