#146 Kubernetes Is Insecure by Default
Show notes
Recorded on the floor of KubeCon, this episode features Ofir Cohen from Wiz (now part of Google). He leads product management and engineering for container and Kubernetes security. Ronald and Jan dive into what modern cloud-native security looks like and why Kubernetes still needs a lot of help to be safe.
We cover:
- The agentless idea behind Wiz: why scanning through cloud APIs beat installing agents on every machine, and how the Log4j incident became the “aha moment” for the industry.
- Security graph and toxic combinations: modelling Kubernetes as its own cloud, so you can ask “if this pod is compromised, what can it reach?” Instead of drowning in findings, you get a curated feed of the issues that truly matter.
- Lessons from the Trivy supply chain attack: poorly separated GitHub organizations, static CI/CD tokens and what “blast radius” really means.
- Kubernetes is insecure by default: the flat network, namespaces that are not a hard security boundary, and Secrets that aren’t secret. Jan and Ofi agree it’s less about technology and more about discipline and culture.
- Identities as the most common mistake: long-lived tokens in Dockerfiles and .env files, and why short-lived, just-in-time credentials (SPIFFE, workload identities) are the way forward.
- Securing the AI era: agents with over-permissive service accounts, the security impact of vibe coding, and Wiz’s upcoming AI plugin for secure-by-default code generation.
- Fun detour: Ofir’s experience writing software for a satellite, from vibration testing to cosmic rays flipping bits.
- The crystal ball: the right level of abstraction on top of Kubernetes, with simple YAML for AI inference and training workloads, and less time spent debugging with kubectl.
A conversation packed with practical security insights for platform engineers, DevOps teams and everyone who runs containers in production.
ACC ICT Specialist in IT-CONTINUÏTEIT
Bedrijfskritische applicaties én data veilig beschikbaar, onafhankelijk van derden, altijd en overal
Two days of cloud native talks, workshops and community in Utrecht, exploring how AI is changing the way we build, run and scale modern platforms.
Like and subscribe! It helps out a lot.
You can also find us on:
De Nederlandse Kubernetes Podcast - YouTube
Nederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTok
De Nederlandse Kubernetes Podcast
Where can you meet us:
Events
This Podcast is powered by:
ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT