Masking PII in Kubernetes: How we solved 3 annoying sidecar edge cases (v2.0.0)

Building a mutating webhook for Kubernetes is easy in tutorials, but brutal in production. You immediately hit the reality of volume permissions, security contexts, and zombie sidecars. I recently released v2.0.0 of the PII-Shield Operator . It’s a Go-based tool that injects a sidecar into your pods to mask sensitive data (PII) before the logs hit Datadog or ELK. Getting the core Shannon entropy logic to work was step one. Making it bulletproof for strict SOC2 environments was step two. Here are