Show Notes
You're integrating HashiCorp Vault into your Kubernetes cluster and adding a temporary debug log line to check whether the ServiceAccount token is being passed correctly. Three months later, that log line is still in production — and the token it prints has a 1-year expiry with no audience restrictions. Vincent von Büren, a platform engineer at ipt in Switzerland, lived through exactly this incident. In this episode, he breaks down why default Kubernetes ServiceAccount tokens are a quiet security risk hiding in plain sight. You will learn: What's actually inside a Kubernetes ServiceAccount JWT (issuer, subject, audience, and expiry)
Why tokens with no audience scoping enable replay attacks across internal and external systems
How Vault's Kubernetes auth method and JWT auth method compare, and when to choose each
What projected tokens are, why they dramatically reduce blast radius, and what's holding teams back from using them
Practical steps for auditing which pods actually need API access and disabling auto-mounting everywhere else
Sponsor This episode is sponsored by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person or remote training. More info Find all the links and info for this episode here: https://ku.bz/LTnB_Ntbc
Interested in sponsoring an episode? Learn more.
More from KubeFM
Non-deterministic agents pose specific challenges for platform teams in observability, state management, governance, and trust. Mauricio (Salaboy) Salatino explains why agentic applications behave like distributed multi-agent systems. His test assigned agents to take an order, cook the pizza, deliver it, and charge the customer. One order crossed 15 containers and produced 200 traces. In this interview: Why agent frameworks can recreate monolith scaling and resource contention
KubeSelect is a new show that tests one bold Kubernetes hypothesis with one expert. Hosts Salman Iqbal and Bart Farrell examine the evidence and ask whether the claim holds up. In episode two, Kat Cosgrove tackles a long-running question: should teams run databases on Kubernetes? StatefulSets, persistent volumes, CSI, and database operators changed the technical answer, but they did not remove the operational risk. In this episode: How Kubernetes storage has matured and why old assumptions persist
Kube Select takes one bold Kubernetes hypothesis and tests it with an expert. In the first episode, Salman Iqbal and Bart Farrell ask whether most organizations have an observability problem or a decision-making problem. Henrik Rexed, Senior Staff Engineer at Dynatrace, challenges the original claim. Teams can collect metrics, logs, and traces, but that telemetry needs system relationships, ownership, and deployment history to support a confident decision. In this episode: Why telemetry without context slows incident response
Kube Signals starts where the keynote ends: with the trends that platform teams will have to operationalize next. In this special episode, Brian Teller speaks with Saiyam Pathak about his KubeCon India keynote and the shift from developer platforms to AI factories. They examine what GPU scarcity, shared accelerators, and AI workloads mean after the conference slides meet real infrastructure. In this interview: Why GPU infrastructure is becoming a platform-engineering concern
At enterprise scale, a deployment pipeline that runs Helm upgrades directly against Kubernetes hides drift, mixes configuration with CI logic, and makes the last pipeline run the source of truth. Elad Cohen explains how WSC Sports moved from Azure DevOps to GitHub Actions and redesigned delivery around Git and Argo CD. The resulting platform separates builds from deployments, keeps service configuration in values files, and continuously reconciles clusters. In this interview: Why CI should change Git instead of the cluster