Recorded on the floor of KubeCon, this episode features Ofir Cohen from Wiz (now part of Google). She leads product management and engineering for container and Kubernetes security. Ronald and Jan dive into what modern cloud-native security looks like and why Kubernetes still needs a lot of help to be safe.

We cover:

• The agentless idea behind Wiz: why scanning through cloud APIs beat installing agents on every machine, and how the Log4j incident became the “aha moment” for the industry.
• Security graph and toxic combinations: modelling Kubernetes as its own cloud, so you can ask “if this pod is compromised, what can it reach?” Instead of drowning in findings, you get a curated feed of the issues that truly matter.
• Lessons from the Trivy supply chain attack: poorly separated GitHub organizations, static CI/CD tokens and what “blast radius” really means.
• Kubernetes is insecure by default: the flat network, namespaces that are not a hard security boundary, and Secrets that aren’t secret. Jan and Ofi agree it’s less about technology and more about discipline and culture.
• Identities as the most common mistake: long-lived tokens in Dockerfiles and .env files, and why short-lived, just-in-time credentials (SPIFFE, workload identities) are the way forward.
• Securing the AI era: agents with over-permissive service accounts, the security impact of vibe coding, and Wiz’s upcoming AI plugin for secure-by-default code generation.
• Fun detour: Ofir’s experience writing software for a satellite, from vibration testing to cosmic rays flipping bits.
• The crystal ball: the right level of abstraction on top of Kubernetes, with simple YAML for AI inference and training workloads, and less time spent debugging with kubectl.

A conversation packed with practical security insights for platform engineers, DevOps teams and everyone who runs containers in production.

Stuur ons een bericht.

ACC ICT Specialist in IT-CONTINUÏTEIT
Bedrijfskritische applicaties én data veilig beschikbaar, onafhankelijk van derden, altijd en overal

Dutch Cloud Native Day 2026

Two days of cloud native talks, workshops and community in Utrecht, exploring how AI is changing the way we build, run and scale modern platforms.

Like and subscribe! It helps out a lot.

You can also find us on:
De Nederlandse Kubernetes Podcast - YouTube
Nederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTok
De Nederlandse Kubernetes Podcast

Where can you meet us:
Events

This Podcast is powered by:
ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT

In this episode, Ronald and Jan talk with Idit Levine, founder and CEO of Solo.io. Idit shares how a single job interview shaped her career and how she picked Kubernetes as the winner when Docker Swarm and Mesos were still in the race.

She is refreshingly honest about service mesh, including where Istio went wrong and why she believes Ambient mode finally gets it right. Then the conversation turns to AI: why agents are stateful workloads that don't fit the classic Kubernetes model, why Solo.io built and donated kagent to the CNCF, and what that means for platform engineers.

We also discuss whether AI will replace engineers, what a young person entering IT should learn today, and Idit's warning to the community: if Kubernetes doesn't evolve for AI workloads, it risks losing relevance.

A candid conversation about vision, mistakes, and the future of cloud native.

Stuur ons een bericht.

ACC ICT Specialist in IT-CONTINUÏTEIT
Bedrijfskritische applicaties én data veilig beschikbaar, onafhankelijk van derden, altijd en overal

Dutch Cloud Native Day 2026

Two days of cloud native talks, workshops and community in Utrecht, exploring how AI is changing the way we build, run and scale modern platforms.

Like and subscribe! It helps out a lot.

You can also find us on:
De Nederlandse Kubernetes Podcast - YouTube
Nederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTok
De Nederlandse Kubernetes Podcast

Where can you meet us:
Events

This Podcast is powered by:
ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT

We sit down with Simone Rodigari, software engineer in Azure Core Container Networking and one of the maintainers of Retina, the eBPF-based observability project. Simone had just delivered his session on Kubernetes networking, and we asked him to give our listeners the same mental model, the one you need when something breaks and you have no idea where to start tracing.

We start at the ground rules: every pod gets an IP, every pod can reach every other pod. That's the expectation Kubernetes sets, but Kubernetes doesn't implement it, the CNI does. Simone walks us through the pod network namespace, the veth pair that works like a virtual cable, and what actually happens to a packet on its way out of the node.

From there we get into the real trade-offs:

• Overlay (VXLAN, IP-in-IP, Geneve) versus underlay and direct routing with BGP portability versus performance, and why the answer is always "it depends"
• Why pods being ephemeral forces the Service abstraction, and how DNAT and load balancing actually work underneath
• kube-proxy modes iptables, IPVS, nftables and why linear rule traversal hurts at scale while eBPF maps give you constant-time lookups
• Where eBPF has its own limits: map sizes, memory and CPU
• Hubble as a Kubernetes-aware tcpdump, and how Retina brings that same flow visibility to any CNI even Flannel
• Jan's production pain: hitting the Cilium identity ceiling on managed AKS and the hack he needed to work around it

We close on the future: operating clusters at massive scale, AI moving from training to inference, and Simone's warning that the community should solve real problems instead of bending Kubernetes to fit every new one.

🎧 A grounded, practical episode for anyone who has ever stared at a dropped packet and wondered which component to blame.

Stuur ons een bericht.

ACC ICT Specialist in IT-CONTINUÏTEIT
Bedrijfskritische applicaties én data veilig beschikbaar, onafhankelijk van derden, altijd en overal

Dutch Cloud Native Day 2026

Two days of cloud native talks, workshops and community in Utrecht, exploring how AI is changing the way we build, run and scale modern platforms.

Like and subscribe! It helps out a lot.

You can also find us on:
De Nederlandse Kubernetes Podcast - YouTube
Nederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTok
De Nederlandse Kubernetes Podcast

Where can you meet us:
Events

This Podcast is powered by:
ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT