Tremolo Security
@tremolo.io
Creators of OpenUnison, the easiest way to add authentication and Namespace as a Service to any Kubernetes cluster. Follow this account for updates! Docs - https://openunison.github.io/
OpenUnison 1.0.51 Release. Maintenance release, updated dependencies for OpenUnison, the operator and kube-oidc-proxy. github.com/TremoloSecur...
Release 1.0.51-2026090901 · TremoloSecurity/OpenUnison
Tasks: 1.0.51 build #1084 bugs: DRSync - ownerReferences causes objects to get deleted #1085
github.com
It's been 2 years since we released the third edition. It's now $30 on Amazon and is still one of the top selling kubernetes books. If you haven't picked it up yet, you should take a look. It will get you through most enterprise focussed topics with labs that we recorded videos for you can follow.
Marc Boorshtein@mlbiam.dev · last yr.Packt is giving Kubernetes: An Enterprise Guide, 3rd Ed away for $38US. Get the paperback, you get the PDF for free. Kube, auth, networking, monitoring, vCluster, Vault, Istio, Pulumi, and more! a.co/d/7dwcw20
OpenUnison 1.0.50 has been released! This is a small release but the operator now handles all webhooks, eliminating issues with conflicts when deploying with Helm. Also, proper ownerReferences make Argo CD work better for deployment too! github.com/TremoloSecur...
Release 1.0.50-2026052501 · TremoloSecurity/OpenUnison
Tasks: 1.0.50 build #1076 enhancements: explicitly shutdown jms sessions #1081 oidc idp - kubernetes sessions - create ownerRef #1080 bugs: Remove headers, session vairables from loginTEst.jsp...
github.com
New OpenUnison! 1.0.49. Includes some more updates for the STS, and flexibility for JWT authentication. Also cleaned up some dependencies. github.com/TremoloSecur...
Release 1.0.49-2026051501 · TremoloSecurity/OpenUnison
Tasks: 1.0.49 build #1070 enhancements: AzureAD Target - Retry patch on 404 #1074 OAuth2JWT - Reload issuer on failure #1073 OAuth2JWT - support credentials for webfinger lookup #1072 Missing nb...
github.com
Just added a new app's RESTful API for user management for a customer. Using our new testing harness we went from zero to production in less then a week. Tested everything offline, then quick rollout. Even integrated short lived tokens, so no API keys!
Captain Jack Sparrow: What Could Possibly Go Wrong?
ALT: Captain Jack Sparrow: What Could Possibly Go Wrong?
static.klipy.com
Marc Boorshtein@mlbiam.dev · 5mo agoThey said it couldn't be done! Short lived tokens to access Claude from on prem clusters with individual keys? Rotate without impacting the rest of the cluster? No API keys? It's madness! Mad? Mad you say? I'LL SHOW YOU MAD! (at @kcd-toronto.bsky.social )
New release of OpenUnison! We've made it even easier to quickly rotate keys for your STS. github.com/TremoloSecur...
Release 1.0.48-2026050401 · TremoloSecurity/OpenUnison
Tasks: 1.0.48 build #1054 1.0.47.1 #1064 bugs: AzureAD Target - add better waiting for account creation #1068 JavaScriptTask not initializing when there are annotations on the Target #1063 enha...
github.com
You kube cluster is on-prem, the api is in the cloud. How do you securely connect? I'll show you how at KCD Toronto! We'll step through how to design a Pod identity that can withstand an attack in the AI age. Hope to see you there! kcdtoronto.ca
KCD Toronto 2026 - Kubernetes Community Days
Join the cloud native and AI community for a day of learning, networking, and collaboration
kcdtoronto.ca
OpenUnison 1.0.46 is now available! Small release to fix a couple of bugs. github.com/TremoloSecur...
Release 1.0.46-2026032001 · TremoloSecurity/OpenUnison
bugs: non http(s) redirects don't get generated properly #1053 oidc auth - overlapping requests overwrites state and code verifier #1052 Tasks: 1.0.46 build #1048
github.com
OpenUnison 1.0.45 has been released! The latest version now supports hot update of keys, so your identity providers can rotate keys automatically without restarts. github.com/TremoloSecur...
Release 1.0.45-2026031201 · TremoloSecurity/OpenUnison
Tasks: 1.0.45 build #1043 bugs: Kubernetes Watches - Increase to 10 minutes #1051 K8s Dynamic Config - failure to start a dynamicly loaded object leads to failed startup #1021 OpenIDConnect IdP ...
github.com
We've updated kube-oidc-proxy. No new features, but have cut known CVEs for the code base to 0! Updated libraries and removed deprecated ones. Integrated into the OpenUnison helm charts. github.com/TremoloSecur...
Release v1.0.10 · TremoloSecurity/kube-oidc-proxy
tasks: 1.0.10 build #74
github.com
This release brings native Headlamp integration, expanded OIDC capabilities, and a new SCIM 2.0 gateway. If you care about Kubernetes identity done right, take a look 👇 www.tremolo.io/post/openuni...
OpenUnison 1.0.44
OpenUnison 1.0.44 adds native Headlamp support, expanded OpenID Connect features, a SCIM 2.0 gateway, and enhanced deployment security with hardened, automated TLS and streamlined namespace and…
tremolo.io
We're going to have a @headlamp.dev plugin for OpenUnison that adds namespace limiting based on an API and a "who am i" page so you can see you ask kubernetes sees you. We're also going to add some other operational support tasks that are common too.
Just finished rewriting Openunison 's Traefik support. Moving forward, Traefik will likely be my go-to Ingress controller. Gateway API support added too but with lack of consistent re-encryption support and no standard for sticky sessions I don't recommend it yet.
This is an appreciation post for people who provide detailed GitHub issues.
a man in an orange shirt is standing with his hands on his hips and says `` who 's awesome ? you are '' .
ALT: a man in an orange shirt is standing with his hands on his hips and says `` who 's awesome ? you are '' .
media.tenor.com
Authenticate Kubernetes workloads to HashiCorp Vault using JWT/OIDC and short-lived tokens—no static ServiceAccount credentials. #Kubernetes #Vault #OIDC #WorkloadIdentity www.tremolo.io/post/short-l...
Short Lived Tokens With Vault Without The Static ServiceAccount
Learn how to securely authenticate Kubernetes workloads with HashiCorp Vault using short-lived tokens instead of static ServiceAccount credentials. This post explains why long-lived ServiceAccount…
tremolo.io
It would be pretty cool if you, I dunno, tossed kube on their and then set it up to securely talk to cloud based systems without any static keys...
a man in a suit and tie says just saying in front of a map
ALT: a man in a suit and tie says just saying in front of a map
media.tenor.com
Marc Boorshtein@mlbiam.dev · 9mo agoI swear these udoo boards were dead. I used to use them at conferences but they stopped working after we had a flood in the house. On a whim I booted them up AND THEY ALL BOOTED! It's a Hanukah miracle!!!! Gonna have to think of a fun project for these.
Rewrote the websockets layer to be simpler, now Head Lamp with impersonation is working great for logs and terminals! Next release will default to Head Lamp instead of the Kubernetes dashboard. Will also remove the need for a second chart.
It'll be OK Marc....
a cartoon character is hugging another character in a room .
ALT: a cartoon character is hugging another character in a room .
media.tenor.com
Marc Boorshtein@mlbiam.dev · 11mo agoWhen you're at the coffee shop working on a lab over your vpn and the proxmox server hosting it just dies....
We deployed Istio...now what? Does it work? Can my app run? How do I know the mesh is running? Join us at noon EST to find out! youtube.com/live/hMFX7EI...
Chapter 16 Part II & Chapter 17 Part I : Building and deploying Applications on Istio
YouTube video by Kubernetes: An Enterprise Guide
youtube.com
We've released OpenUnison 1.0.43! We've made building Security Token Services easier, simplified kubernetes logins with a new kubectl plugin, and made privileged access to Kubernetes a snap. Check out our new features with more blog posts coming soon! www.tremolo.io/post/openuni...
OpenUnison 1.0.43
Feature summary for OpenUnison 1.0.43.
tremolo.io
Trick or treat, smell my skeet, give me a great service mesh. If you don't, I don't care, I'll pull out your token there! OK, know it doesn't all rhyme but let's learn how to deploy Istio!
Chapter 16: An Introduction to Istio
It might be the start of spooky season, but your service mesh doesn't need to be scary! We're going to introduce you to Istio and the concepts of service mes...
youtube.com
Your Pods, they're talking to you....can you hear them? We'll walk through how Kubernetes manages your logs using OpenSearch. youtube.com/live/VeArPBy...
Chapter 15: Monitoring Clusters and Workloads Part II - OpenSearch
YouTube video by Kubernetes: An Enterprise Guide
youtube.com
a cartoon character is hugging another character in a room .
ALT: a cartoon character is hugging another character in a room .
media.tenor.com
Marc Boorshtein@mlbiam.dev · last yr.My dev talos cluster is borked. I could fix it but probably just easier to rebuild. That's five minutes of my life I'm never getting back.
No, also, no one likes old pictures of them being posted on socials without their permission!!!!!
Marc Boorshtein@mlbiam.dev · last yr.Remember when you could just find one of these in a parking lot and plug it into a production system to see what was on it and everything would be OK?
