Harsh Raj

Harsh Raj Kubernetes internals & security

Drag to look around. Click an object to open it.

11 pull requests · 7 CNCF projects · 3 merged

The desk

About

I test whether systems do what they report. Mostly in CNCF projects: controllers, admission, policy engines and autoscaling.

I'm a final-year B.Tech student in Computer Science (Cybersecurity and Forensics) at UPES, graduating in 2027. Most of my work starts from a system saying one thing while doing another, and ends with a fix and a test that proves it.

Experience

Software Developer Intern, IBM: Jun – Jul 2026. A multilingual RAG assistant over LLaMA 3.2, with a one-click risk report built from live geolocation, weather, air quality and disaster data.
Cybersecurity Intern, Safepay: Jun – Jul 2025. Triaged 50+ SIEM alerts and ran Nmap and OpenVAS assessments that surfaced 15+ exposed services, written up as playbooks the team adopted.

The rack · status is live from GitHub

Findings

merged kedacore/keda #8193

A connection pool that never let go

The external scaler released a pooled gRPC connection only once it reached Shutdown, which only its own cleanup could trigger. Every address and TLS combination ever configured kept a connection and a goroutine for the life of the process.

Measured on a real operator and API server: held connections 5 → 10 → 15 across three cycles before, 0 → 0 → 0 after.
View PR
merged kyverno/kyverno #17608 · #17612

A policy check that passed while checking nothing

The Kyverno CLI resolved no resource kinds for namespaced validating policies, so they ran against an empty set and reported a clean pass. Fixed and backported to the release branch.
View PR
open pipe-cd/pipecd #7412

A rollback reported as synced on the old revision

ECS rollbacks tagged the service with the target commit instead of the one actually running, so the app showed as synced while running the old revision.
View PR
open kgateway-dev/kgateway #14749

Accepted, while the backend was rejected

A BackendConfigPolicy with an invalid CA certificate reported Accepted while Envoy refused the cluster. The certificate is now validated and the policy names the Secret at fault.
View PR
open kyverno/kyverno #17620

One patch value that crashed the webhook

An unrecovered panic when a MutatingPolicy's JSON patch sets a list of object initializers took down the mutating webhook and failed every affected admission request.
View PR
open openkruise/agents #1001

Claim labels overwriting controller labels

Labels propagated from a SandboxClaim could overwrite labels the controller owns. Reserved-prefix labels are now filtered out of propagation.
View PR
open kubeedge/kubeedge #7306 · #7307

Offline edge nodes that could not start pods

Edge nodes lost the ability to start pods that mount a service account token while offline. The fixes query cached tokens by key and fall back to the cached token when refresh fails.
View PR
open volcano-sh/volcano #6002

HyperNode members matched too loosely

Enforces exact matching for HyperNode-typed members.
View PR

The gate

Built

sigstore-guard

Go · Kubernetes · Sigstore · TUF

The gate in the room is this. A validating admission webhook, about 4,000 lines of Go, that rejects pods whose images carry no Sigstore signature from an accepted signer. The trust root is anchored in TUF, so key rotation reaches clusters as a metadata refresh with no redeploy. The API server's failurePolicy and the policy's own failOpen are kept as two separate controls.

Source

PhishArmor

Python · PyTorch · Transformers

A multimodal phishing detector combining URL, text and screenshot models, with SHAP and Grad-CAM explanations. Along the way I found 37.3% duplicate crops leaking between train and test in a public benchmark, which moved top-1 retrieval accuracy from 0.859 to 0.668.

Darkscan

Go · Tor · Forensics

A concurrent scanner that fingerprints .onion services across seven protocols through a Tor SOCKS5 proxy, with a dependency-free EXIF parser that recovers GPS and camera metadata.

The mailbox

Contact

Open to internships and to talking about any of the work here.

harshrajdebug@gmail.com