Security
Mutual TLS (mTLS) requires both client and server to present certificates during the TLS handshake. It's the standard authentication mechanism for service-to-service communication in microservices, and increasingly used for API access in zero-trust architectures. Testing mTLS is distinct from standard TLS testing — you need to
Testing
Every system call a container makes is an attack surface. seccomp (Secure Computing Mode) lets you define exactly which syscalls a container is allowed to make — and kill or log anything outside that list. The challenge is writing profiles that are tight enough to restrict attacker behavior but permissive enough
Testing
Pod Security Standards (PSS) replaced PodSecurityPolicy (PSP) in Kubernetes 1.25. They define three security levels for pods — Privileged, Baseline, and Restricted — and the Pod Security Admission (PSA) controller enforces them at the namespace level. But "enforces" only works if you actually test that your manifests comply. This
Testing
Runtime security is the last line of defense. If a container escapes, an attacker pivots laterally, or malware executes inside your cluster — Falco is what catches it. But Falco rules that go untested are rules that fail silently when it matters most. This guide covers how to write, validate, and
Testing
OPA Gatekeeper extends Kubernetes admission control with custom policies written in Rego. When a pod, service, or configmap is created or updated, Gatekeeper evaluates it against your policies and either admits or rejects the request. The problem is most teams write Gatekeeper policies without any tests, discovering failures only when
Testing
Mandatory Access Control (MAC) is what runs underneath discretionary permissions. Even if a process runs as root, AppArmor and SELinux can restrict which files it reads, which network ports it uses, and which capabilities it exercises. For containers, these are critical layers of defense-in-depth. The gap most teams
DevOps
Flux automates GitOps deployments, which means a broken Kustomization or HelmRelease can silently fail to reconcile — or worse, reconcile incorrectly — without anyone noticing until a production incident. This guide covers the full Flux testing stack: flux build for local manifest rendering, flux diff for live drift detection, envtest for controller
DevOps
ArgoCD makes GitOps deployments feel effortless — until a bad sync silently rolls out a broken config to 40 namespaces via an ApplicationSet. This guide covers how to validate ArgoCD applications, ApplicationSets, and sync policies before they reach a production cluster, using argocd app diff, local kind/k3d clusters, and automated
DevOps
Crossplane Compositions are Kubernetes-native infrastructure templates that expand a simple XR claim into tens of managed resources. A bug in a Composition can delete a production RDS instance when someone creates a new database claim. This guide covers how to test Composition logic with crossplane beta render, unit-test
DevOps
Helm charts are complex Go templates that generate Kubernetes manifests. A chart that lints cleanly can still produce broken YAML, silently wrong values, or manifests that fail admission webhooks. This guide covers the full testing stack: helm lint for static analysis, helm template for manifest inspection, chart-testing (ct) for
Chaos Engineering
LitmusChaos is a CNCF-graduated chaos engineering platform built natively for Kubernetes. It uses Kubernetes-native custom resources to define, run, and observe chaos experiments — no external tools, no sidecars, no proprietary agents. Chaos experiments are just YAML that runs in your cluster like any other workload. Why Chaos Engineering
SRE
Chaos engineering is the practice of deliberately introducing failures into a system to discover weaknesses before they cause incidents. Netflix coined the term with Chaos Monkey — a tool that randomly terminates EC2 instances to force engineers to build resilient services. For Kubernetes workloads, Litmus Chaos has become the most widely