jwright b18c6589bf blog: 'The most secure credential is the one you never mount' ...

Least-privilege for Kubernetes workloads — own ServiceAccount + no auto-mounted
API token, then non-root + dropped caps, then Pod Security as the enforced floor.
Adds a matching house-style SVG diagram (workload-least-privilege).

2026-06-23 19:17:03 +10:00

..

authentik-sso.svg

Add SSO+2FA and outbound-exposure posts with Excalidraw architecture diagrams; Diagram component serves outlined SVGs

2026-06-22 16:26:15 +10:00

edge-ai.svg

Add SSO+2FA and outbound-exposure posts with Excalidraw architecture diagrams; Diagram component serves outlined SVGs

2026-06-22 16:26:15 +10:00

homelab.svg

Add SSO+2FA and outbound-exposure posts with Excalidraw architecture diagrams; Diagram component serves outlined SVGs

2026-06-22 16:26:15 +10:00

iac-fleet.svg

Add SSO+2FA and outbound-exposure posts with Excalidraw architecture diagrams; Diagram component serves outlined SVGs

2026-06-22 16:26:15 +10:00

outbound-exposure.svg

Add SSO+2FA and outbound-exposure posts with Excalidraw architecture diagrams; Diagram component serves outlined SVGs

2026-06-22 16:26:15 +10:00

workload-least-privilege.svg

blog: 'The most secure credential is the one you never mount'

2026-06-23 19:17:03 +10:00