#zero-trust

Networking & DNS Bug Report

Default-deny NetworkPolicy shipped, every service lost DNS: allowing egress to kube-dns

Priya Raghavan · Sep 17, 2026 · 7 min read

We rolled out a default-deny egress NetworkPolicy to a namespace and every pod immediately failed to resolve names, including other services in the same namespace. Policies select pods, DNS runs in kube-system, and the namespace selector needed the right label. The policy set we use now and how we test it.

Security

Zero trust in practice and threat modeling with STRIDE, worked through on a file upload feature

Grace Liu · Sep 1, 2026 · 6 min read

Zero trust and threat modeling are often presented as frameworks for large organisations. Both are simple ideas for any team: never trust the network, verify every request, and find threats on a whiteboard before production. With a STRIDE threat model of a real file upload feature.