Security on DevOps & Rock'N'Roll

Letting Claude loose on an AWS account with Prowler

Tue, 11 Aug 2026 00:08:30 +0000

I had been meaning to run a proper security audit of one of our AWS accounts for months. The task kept losing to more urgent things, because it isn’t a single job — it’s install a scanner, work out its permissions, run it for an hour, then read several thousand findings and decide which twelve actually matter.

So I gave the whole thing to Claude Code and watched. The interesting part wasn’t that it worked; it was where the effort actually went.

Wrapping Kyverno policies into a chart you can actually tune

Tue, 07 Jul 2026 00:08:30 +0000

Kyverno’s policy library is excellent and you should read it. It is also a directory of static YAML files, which means adopting it looks like copying twenty ClusterPolicy manifests into your GitOps repo and then editing them by hand, per cluster, forever.

That works until the second cluster. Dev wants audit where prod wants enforce. The infra cluster needs the CRI socket policy relaxed because your monitoring agent legitimately mounts it. A new namespace needs to be excluded from the Flux label requirement. Each of these is a one-line change to a file that’s now duplicated across three repositories, and none of them are visible from a single place.

IRSA to Pod Identity: notes from the migration

Tue, 02 Jun 2026 00:08:30 +0000

IRSA has been the way to give a Kubernetes pod an AWS identity since 2019, and it works. It also requires an OIDC provider per cluster, a trust policy per role that names a specific cluster’s OIDC issuer, and a mental model involving projected service account tokens that you re-derive from scratch every time something breaks.

EKS Pod Identity does the same job with less machinery. I’ve now moved a few clusters over and it’s mostly good news, with a couple of edges worth knowing before you start.

EKS Access Entries: one ARN, one cluster, no sharing

Tue, 21 Apr 2026 00:08:30 +0000

EKS Access Entries replaced the aws-auth ConfigMap and made cluster authorization a proper AWS API object instead of a YAML blob that you edited with trembling hands, hoping you wouldn’t lock yourself out. It’s a genuine improvement. But moving auth into the API surface also moves it into Terraform state, and that’s where it gets interesting.

The error that sent me down this road:

Error: creating EKS Access Entry (test-spain-001:arn:aws:iam::123456789012:role/PlatformAdmin):
ResourceInUseException: The specified access entry resource is already in use
on this cluster.

My first reaction was the wrong one: are access entries global? Did creating one for cluster A break cluster B?

Yet another Vault story

Fri, 06 Oct 2023 00:08:30 +0000

One can find a million blog posts about various aspects of using Hashicorp Vault, this solution has truly received massive adoption. So now you don’t even question what you’re going to use as secrets storage, but the matter is more of “how”.

Being a complete and inveterate gitops’er, one of my primary objectives is to store as much as I can in Git and to deploy that into Kubernetes. This brought me to the BanzaiCloud Bank Vaults solution bundle that allows you to achieve exactly this. It provides the ability to configure Vault as a Custom Resource and store all its primary settings on a repository. This is not very far from the official Helm chart deployment with their values, but BanzaiCloud give you a bit more: