Tag: Kubernetes
All the articles with the tag "Kubernetes".
Selecting more than one tag in the sidebar shows only posts that have every selected tag.
- #SRE#Kubernetes#Observability
Lineth L2 Homelab - A Full Rollup on One Kubernetes Node, and How I Watch It
A tour of my SRE homelab: a local proof-of-stake L1 and a complete zk-rollup L2 running as 60+ pods on a single kind node on a Mac, deployed by Flux, and monitored with Prometheus, Loki, Tempo, SLOs and 26 Grafana dashboards. Screenshots taken from the live lab.
12 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (4) - Alive but Dead: 12 Hours Without Grafana
A supervised kubectl port-forward lost its stream during a node memory stall and logged the same error 1,929 times over 12 hours. The process stayed alive, so its supervisor never restarted it. A Google SRE format postmortem on monitoring the monitoring, with the logs and a fix tested by injecting the failure.
5 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (3) - Started Before DNS: An RPC Node With No Peer for 49 Minutes
After a planned restart, the L2's public RPC node came up a few seconds before cluster DNS, failed to resolve its only peer once, and never tried again. It looked healthy for 49 minutes while no user transaction reached the sequencer. A Google SRE format postmortem with the logs and a one-probe fix.
7 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (5) - Reviewing the Setup Against Google SRE
I reviewed the L402 payment gate's monitoring and on-call agent against the Google SRE Book and Workbook. Eight practices, what the review found, what changed, and the gaps that are still open.
9 min read - #Lightning Network#lnd#Routing
Relaying a Test Payment Through a Testnet LND Node
Using two testnet LND nodes on a Mac and in WSL, a 10-sat self-payment is routed through the WSL node, after finding and fixing a disabled channel policy, and checked against the node's forwarding history.
15 min read - #Lightning Network#lnd#Routing
Checking Routing Readiness on a Testnet LND Node
Before changing any fee policy, a read-only check of a testnet LND node on Kubernetes in WSL covering pod state, chain and graph sync, channel liquidity by direction, SCIDs, and per-channel fee and HTLC policies.
8 min read - #AI#Kubernetes#Aperture
Diagnosing OpenCTI with Kagent (4) - Rehearsing Incidents with an LLM Agent
I rehearsed incidents against a Kagent on-call agent watching an Aperture L402 payment gate, then scored it against a playbook. The exercise found gaps in my own alerts too.
8 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (3) - Designing Access Control in a GitOps Setup
Access control for kagent has two sides, who can change an agent and what a running agent can reach. How I split them across Git review, GitOps, RBAC, MCP, application, and database controls.
16 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (2) - Tools, Code-First Diagnosis, and Read-Only Access
The four MCP tools behind the paid-service diagnosis agent, why the code classifies the state before the model explains it, and how Kubernetes access stays read-only.
5 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (1) - Architecture: Agent, Model, and MCP Server
How I built a diagnosis agent for a paid OpenCTI and ASM service on kagent, and how the Helm values, Agent, ModelConfig, system prompt, and MCP server fit together.
5 min read - #Kagent#Prometheus#Kubernetes
Prometheus Alert Rules: Helm Values or PrometheusRule Files?
Where Prometheus alerts come from in kube-prometheus-stack, and why I keep the install in Helm values but each service's alerts in its own PrometheusRule file.
3 min read - #Kagent#LND on Kubernetes#Prometheus
Metrics Collector: Prometheus on LND
Before an incident-response drill, the node needs metrics. How lndmon turns LND's state into Prometheus metrics, and how to read the /metrics format by hand.
3 min read - #LND on Kubernetes#Lightning Network#Kubernetes
Running an LND Lightning Node on Local Kubernetes: Designing for State, Identity, and Recovery
A Lightning node is state, not just a process. How I mapped LND's wallet, channel, and recovery model onto StatefulSets, PVCs, NetworkPolicy, and tests on local K3s.
13 min read - #Blockchain#Hoodi#Validator
Hoodi Validator Use Cases and Data Flows
How Hoodi execution, consensus, validation, signing, and observability components exchange data in a Kubernetes-based validator platform.
3 min read - #Vault#Kubernetes#Hoodi
cert-manager and Vault: Roles, Scope, and Collaboration
How cert-manager, Vault, Kubernetes, and AWS KMS work together to protect Vault transport, workload identity, and validator secrets.
15 min read - #Vault#Identity Management#Kubernetes
Identity Management Using Vault
How Vault, Kubernetes, AWS, and GitHub divide responsibility for workload, operator, and release identities.
7 min read - #Kubernetes#EKS#Hoodi
Kubernetes Namespace Design for a Hoodi Validator
A security-focused guide to designing Kubernetes namespace boundaries for a Hoodi validator architecture.
6 min read - #Vault#Kubernetes#EKS
Vault Architecture on Kubernetes
A practical guide to Vault architecture, workload identity, secret delivery, PKI, and operations on Kubernetes.
8 min read - #Vault#Ethereum#Hoodi
Vault Secret Management for Hoodi Validator
How Vault Agent delivers validator secrets for Engine API authentication, TLS, signing, and slashing protection.
8 min read - #AWS#ECR#EKS
Private ECR Delivery Architecture for Private EKS
A defense-in-depth design for delivering approved private ECR artifacts to private EKS workloads.
Updated:15 min read - #AWS#EKS#Kubernetes
EKS Security Controls Implemented in the Cluster Design
A technical overview of EKS security controls implemented across the cluster design.
8 min read - #Ethereum#Hoodi#AWS
Private EKS Security Design Review
A confidentiality-focused security design review of a private EKS environment.
10 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Local Accounts Check to Prowler
How Prowler identifies AKS clusters that still allow local Kubernetes accounts to bypass Microsoft Entra ID authentication.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Monitor Check to Prowler
How Prowler identifies AKS clusters without Azure Monitor managed Prometheus metrics enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Defender Check to Prowler
How Prowler identifies AKS clusters without Microsoft Defender for Containers security monitoring enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Auto-Upgrade Check to Prowler
How Prowler identifies AKS clusters without an automatic Kubernetes upgrade channel and helps prevent version drift.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (10) - Regulatory Overlays
Applying PIPA/ISMS-P and customer contractual obligations on top of the EKS SaaS baseline, and why tenant deletion is a control-plane workflow, not a single DynamoDB delete.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (9) - CI/CD Verification
Gating EKS SaaS deployments on requirement IDs, from rendering Helm and Kustomize manifests to running tenant-boundary tests across Cognito pools.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (8) - Evidence and Review
Why an EKS SaaS requirement is a criterion rather than proof, and how the plugin ties NetworkPolicy, IRSA, and tenant-context requirements to evidence-based status.
2 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (7) - Refresh and Lifecycle
Refreshing the EKS SaaS security contract as ingress, cluster topology, and IAM bindings change, without losing prior approvals, evidence, or requirement history.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (6) - Authoring, Validation, and Publication
Writing atomic, verifiable EKS SaaS requirements for tenant identity, network isolation, IRSA, and the provisioning pipeline, validated by code before publication.
5 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (5) - Responsibility and Prioritization
Splitting EKS SaaS work across AWS, the platform team, product teams, and the SaaS operator, and why IRSA and shared controllers need more than one owner.
6 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (4) - Blast Radius
Calculating blast radius across the AWS EKS SaaS reference architecture, from a contained siloed order table to a provisioning pipeline that can reach the whole account.
5 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (3) - Threat Analysis
A ten-threat model across the AWS EKS SaaS reference architecture's shared control plane, tenant namespaces, ingress routing, and IAM Roles for Service Accounts.
8 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (2) - CIA Impact and Baseline
Calculating CIA impact for the AWS EKS SaaS reference architecture, where pooled and siloed DynamoDB models and a shared control plane both feed the result.
7 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (1) - Service Analysis
Building a confirmed service profile for AWS's EKS SaaS reference architecture, where namespace-per-tenant isolation and a shared control plane change what counts as a boundary.
6 min read - #Security Requirements Plugin#Security Design#Security Requirements
Security Requirements Plugin - Kubernetes Analysis Added
Turning Kubernetes manifests into a security graph so RBAC, NetworkPolicy, service mesh, and cloud IAM relationships feed blast-radius and requirements analysis.
9 min read