Ugo Giordano
Senior Software Engineer, Ph.D.
Platform security engineer at Red Hat, working on OpenShift AI. I find vulnerabilities in Kubernetes operators, build libraries to fix them structurally, and create AI-powered tooling for security analysis at scale. Previously at Nokia Bell Labs researching SDN reliability.
Featured Projects
operator-security-runtime
Found a CVSS 9.1 privilege escalation across RHOAI operators. Built a Go library that replaces cluster-wide permissions with per-namespace scoped Roles, validated with a 200-trial performance framework.
Operator Chaos
Chaos engineering framework for Kubernetes operators. Injects faults into controller reconciliation loops to validate resilience and recovery behavior.
Architecture Analyzer
Static analysis tool that extracts CRDs, RBAC rules, security contexts, and network policies from Kubernetes operator source code. Builds multi-language code property graphs (Go, Python, TS, Rust) with taint analysis.
Adversarial Reviewing
Multi-agent adversarial code review system. Isolated specialist agents (security, architecture, correctness) analyze code independently, then challenge each other through structured debate rounds.
Latest Posts
-
429 chaos experiments across 22 operators: what actually broke
I ran operator-chaos against 22 Kubernetes operators with 429 experiments. PodKill mostly passed. DeploymentScaleZero and NetworkPartition revealed the real gaps. Then I built chaos-instrumented operator images using the SDK and found 4 new bugs plus 2 RBAC gaps that CLI testing could never reach.
-
Chaos engineering for Kubernetes operators: testing what actually matters
Traditional chaos tools kill pods and watch them restart. But operators manage entire resource graphs, not just Deployments. I built operator-chaos to test the real question: does the operator detect and correct drift across everything it manages?
-
Why your RBAC linter misses privilege escalation chains
kube-linter catches wildcards and cluster-admin bindings. But it cannot detect indirect privilege escalation through binding chains. Here is what it misses and how kube-chainsaw fixes it.