# When guardrails break prod: GitHub “Too Many Requests” from legacy defenses, Kubernetes nodes/proxy GET RCE, HCP Vault resilience in an AWS regional outage, and PCI DSS scope creep

Page: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/when-guardrails-break-prod-github-too-many-requests-from-legacy-defenses-kubernetes-nodes-proxy-get-rce-hcp-vault-resilience-in-an-aws-regional-outage-and-pci-dss-scope-creep
Text version: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/when-guardrails-break-prod-github-too-many-requests-from-legacy-defenses-kubernetes-nodes-proxy-get-rce-hcp-vault-resilience-in-an-aws-regional-outage-and-pci-dss-scope-creep.md
Podcast: [Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News](https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275)
Published: 2026-02-13T04:45:00+00:00
Episode link: https://rss.com/podcasts/ship-it-weekly/2545647
Audio file: https://content.rss.com/episodes/356364/2545647/ship-it-weekly/2026_02_13_03_39_51_2cc8ffa5-a6c7-4b4b-8377-d28dc07b0c69.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/when-guardrails-break-prod-github-too-many-requests-from-legacy-defenses-kubernetes-nodes-proxy-get-rce-hcp-vault-resilience-in-an-aws-regional-outage-and-pci-dss-scope-creep
Duration seconds: 949

## Resource

This week on Ship It Weekly , Brian hits four stories where the guardrails become the incident. GitHub had “Too Many Requests” caused by legacy abuse protections that outlived their moment. Takeaway: controls need owners, visibility, and a retirement plan. Kubernetes has a nasty edge case where nodes/proxy GET can turn into command execution via WebSocket behavior. If you’ve ever handed out “telemetry” RBAC broadly, go audit it. HashiCorp shared how HCP Vault handled a real AWS regional disruption: control plane wobbled, Dedicated data planes kept serving. Control plane vs data plane separation paying off. AWS expanded its PCI DSS compliance package with more services and the Asia Pacific (Taipei) region. Scope changes don’t break prod today, but they turn into evidence churn later if you don’t standardize proof. Human story: “reasonable assurance” turning into busywork. Links GitHub: When protections outlive their purpose (legacy defenses + lifecycle) https://github.blog/engineering/infrastructure/when-protections-outlive-their-purpose-a-lesson-on-managing-defense-systems-at-scale/ Kubernetes nodes/proxy GET → RCE (analysis) https://grahamhelton.com/blog/nodes-proxy-rce OpenFaaS guidance / mitigation notes https://www.openfaas.com/blog/kubernetes-node-proxy-rce/ HCP Vault resilience during real AWS regional outages https://www.hashicorp.com/blog/how-resilient-is-hcp-vault-during-real-aws-regional-outages AWS: Fall 2025 PCI DSS compliance package update https://aws.amazon.com/blogs/security/fall-2025-pci-dss-compliance-package-available-now/ GitHub Actions: self-hosted runner minimum version enforcement extended https://github.blog/changelog/2026-02-05-github-actions-self-hosted-runner-minimum-version-enforcement-extended/ Headlamp in 2025: Project Highlights (SIG UI)…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/when-guardrails-break-prod-github-too-many-requests-from-legacy-defenses-kubernetes-nodes-proxy-get-rce-hcp-vault-resilience-in-an-aws-regional-outage-and-pci-dss-scope-creep/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/when-guardrails-break-prod-github-too-many-requests-from-legacy-defenses-kubernetes-nodes-proxy-get-rce-hcp-vault-resilience-in-an-aws-regional-outage-and-pci-dss-scope-creep.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.