With most compromises typically detected within days, dependency cooldowns are an effective circuit breaker, as research shows 8 in 10 major attacks had exploit windows of under a week. By letting an artifact age in public view, you give scanners, researchers, and upstream maintainers a window of time to catch what automated malware tools can release at scale in a few minutes. Notably, for this to work, the publish time needs to be trustworthy. Flux Mirror measures minAge against the Rekor transparency log timestamp, which is countersigned so it can’t be quietly rewritten later. This keeps compromised packages from landing in your registry before the industry has had enough time to examine them. To find out more, read the blog: fluxcd.io/blog/2026/08/flux-…

With most compromises typically detected within days, dependency cooldowns are an effective circuit breaker, as research shows 8 in 10 major attacks had exploit windows of under a week. By letting an artifact age in public view, you give scanners, researchers, and upstream maintainers a window of time to catch what automated malware tools can release at scale in a few minutes. Notably, for this to work, the publish time needs to be trustworthy. Flux Mirror measures minAge against the Rekor transparency log timestamp, which is countersigned so it can’t be quietly rewritten later. This keeps compromised packages from landing in your registry before the industry has had enough time to examine them. To find out more read the blog: fluxcd.io/blog/2026/08/flux-…

Operating enterprise secrets management on Kubernetes shouldn't require battling the fragile Raft consensus protocol. We’ve engineered PostgreSQL into a first-class data storage engine for Enterprise for @openbaoofficial, delivering: ⚖️ Horizontal read scalability achieves full parity with existing Raft support 🎯 Better client consistency control semantics ✅ An internal test suite to validate the behaviour of secret engines Read the full post: control-plane.io/posts/enter…

Attending BSides Canberra this week? Get ready to delve into the dark and mysterious world of Kubernetes security! Mario Weigel, Senior Consultant, and Aiman Alsari, Head of Asia Pacific, will be running the Kubernetes Capture the Flag event. Whether you are a beginner eager to learn or a hardened veteran, there is a challenge for you with three increasingly demanding scenarios 🚩 Read the full details and add it to your schedule: cfp.bsidescbr.com.au/bsides-…

What happens if an attacker gets root access to your SPIRE server? 🚨 In our recent blog, we dive into how to leverage @openbaoofficial Transit Secrets Engine as "Cryptography as a Service." Stop leaving your most critical keys exposed in memory. Dive into the technical configuration now control-plane.io/posts/secur…

What does a truly ‘sovereign’ signing pipeline look like for GitOps? To meet sovereignty requirements, we define a hard boundary: the signing key remains strictly within self-hosted infrastructure, and neither signing nor verification relies on external services. Our blog on sovereign signing walks through a GitOps delivery pipeline where every link in the chain, from OpenBao key storage to Flux verification, is completely self-hosted and vendor-neutral.

Next week, our CEO, Andrew Martin, is heading to Amsterdam for AGNTCon + MCPCon Europe! The primary focus over the two days is on exploring how teams can build, test, operate, and scale agent systems securely and reliably, transitioning them from initial prototypes to production environments. Are you attending AGNTCon + MCPCon? Let us know if you want to connect!

Highly privileged Kubernetes tools like cert-manager and @kyverno are vital for cluster security, but misconfigurations can easily create direct paths to full cluster compromise. To address these operational risks, ControlPlane collaborated with the @CloudNativeFdn (CNCF) and @linuxfoundation to publish two comprehensive threat modelling and hardening resources. Read our full blog post to explore the key takeaways and download the threat models to harden your cloud native infrastructure. control-plane.io/posts/harde…

Time is running out! ⏳ The deadline for the OpenUK Annual Awards is coming up this Sunday, September 6th. We are the proud sponsor of the Security category this year. If you know someone doing incredible work, make sure they get the recognition they deserve. openuk.uk/awards/

In the age of AI, Linus’s Law that "given enough eyeballs, all bugs are shallow" has mutated into “given enough prompts to AI agents, all bugs will be exploited”. To build true resilience, leadership must pivot toward Attestation-Based Security. By shifting the burden of proof from your security team to an automated pipeline, you can programmatically reject any artifact that lacks a verified chain of custody. Is your organization still relying on static inventory, or are you validating integrity? control-plane.io/posts/from-…

Mirroring Kubernetes artifacts usually meant maintaining separate scripts for images and charts, with no built-in way to verify integrity. @fluxcd Mirror handles artifact relocation in a single declarative config, verifying content before a single byte lands in your registry. Read the walkthrough here fluxcd.io/blog/2026/08/flux-…

Non-human identity management is one of the most critical, and frequently misconfigured, aspects of modern platform engineering. In our dedicated @OpenBao interactive tutorial on @Iximiuz Labs, we break down how to properly architect application-level authentication from scratch. labs.iximiuz.com/tutorials/o…

DevSecOps embeds automated security controls into every single stage of the software development lifecycle, from initial planning to continuous monitoring. Moving security from a final hurdle before software release to part of an integrated DevSecOps model delivers tangible organisational benefits and strengthens security posture. Read more in our latest blog. control-plane.io/posts/dev-s…

Read the recent article from IT Brief Australia breaking down why @openbaoofficial is rapidly gaining ground as a highly credible secrets management tool for large organizations. #OpenBao #OpenSource #Cybersecurity #SecretsManagement itbrief.com.au/story/nvidia-…

In our interactive @fluxcd 2.9 tutorial on @iximiuz Labs, you don't just learn how to deploy, you learn how to fix things when they break: Catch Errors Early: Use flux schema validate to prevent broken manifests from reaching the cluster Inspect Live Cluster State: Leverage the Flux Operator Web UI to pinpoint stuck resources in real time New Plugin System: Accelerate your workflow with Operator directly available in the CLI labs.iximiuz.com/tutorials/f…

What happens when autonomous AI agents break out of their evaluation environments? Our latest blog explores recent incidents where frontier AI agents bypassed isolation controls and breached unconsenting organizations. control-plane.io/posts/agent…

When you pull images directly from public registries in your Kubernetes Deployments, you make their uptime, rate limits, and retention policy part of your production architecture. Flux Mirror is a powerful CLI plugin that mirrors container images, Helm charts, and OCI artifacts between registries from a declarative configuration. So you can maintain continuous operational control over these dependencies using your own registries, with verification policies enforced at the time of syncing. deploy-preview-2641--fluxcd.…

We need to slow the spread of these supply chain attacks. Check out `flux mirror` and its declarative config:

Stop passing static tokens or human credentials to microservices. Let’s build real non-human secret management with @openbaoofficial. In this interactive @iximiuz tutorial, you’ll step into a live environment and configure application-level security from scratch. labs.iximiuz.com/tutorials/o…

The EU Cyber Resilience Act (CRA) has shifted from a future regulatory discussion to an immediate operational reality. Is your organisation ready?🇪🇺🔒 Navigating the transition to CRA compliance requires a clear path forward. This upcoming @openssf Tech Talk featuring John Kjell, Principal Consultant at ControlPlane, will help you prepare. Register today to secure your spot: openssf.org/resources/tech-t…