Security on RLGeeX

Organization Policies at Scale: Attach High, Pick Managed Constraints, Roll Out in Dry Run

Tue, 10 Nov 2026 09:00:00 -0500

This post is for cloud engineers building a GCP foundation with Terraform who want Organization Policy to keep working once the hierarchy grows past a few projects. My argument is that org policy at scale comes down to three decisions. Attach constraints as high in the hierarchy as you can. Handle exceptions with conditions, not scattered overrides. Once other teams own workloads, never enforce a new constraint until it has run in dry-run mode. By the end you should know where each policy belongs, which kind of constraint to reach for, and how to promote one from observed to enforced.

Default-deny network policies for tenant isolation on GKE

Thu, 05 Nov 2026 09:00:00 -0500

This post is for platform teams running multi-tenant Kubernetes on GCP, where each team or customer gets its own namespace. Network policies are the right tool for isolating services from each other, but they isolate only the pods a policy selects. The real work is setting a default-deny baseline in every tenant namespace and then allowing traffic on purpose. Below I cover what to turn on, the order I’d roll it out in, and where policies stop protecting you.

RBAC in a Shared Kubernetes Cluster: Namespace First, Then Audit What Escalates

Tue, 06 Jan 2026 09:00:00 -0500

This post is for platform teams running multi-tenant Kubernetes on GCP, where several teams share one cluster. RBAC is the isolation control you should design first, because it protects all the others. Below is a default binding pattern and a list of grants to audit. The short version is to scope tenant access to namespaces with RoleBindings that point at a small set of shared ClusterRoles. Then check for escalation paths, not just for who can read what.