A workspace where humans and agents build together, on a relay you own.

This page is the full reference: every mechanism, every qualifier, both modifiers, the complete macro table, evaluation order, DNS lookup limits, and record placement rules — each with the RFC 7208 section that defines it.

A Primer on Log Sources and Ingestion Strategy

Scope, Not Volume: Detecting Credential Abuse in Kubernetes

We shipped the first version internally on March 12, four days after the first commit. This post isn't about those four days. It's about everything that broke once real people started using it, and the three weeks of fixes, security patches, and production incidents that followed.

Not a smarter alert. Not a better dashboard. An actual reasoning system — one that reads Splunk, queries AppDynamics, checks the Kubernetes pods, searches the Confluence runbooks, looks at what GitLab deployed recently, and comes back with a diagnosis and a proposed action.

That is what this series is about: building an open source Kubernetes security console that collects posture, vulnerability, policy, and runtime signals, exposes them through Kubernetes-native objects where possible, and wires that data into an MCP server so an AI agent can help triage across the whole stack.

I migrated the entire k3s cluster from a flat network to a proper VLAN architecture: Server VLAN 20 for k3s nodes and services, Storage VLAN 30 for the NAS, and the existing default VLAN 1 for clients. This involved changing IPs on all VMs, updating MetalLB, reconfiguring Traefik, and recovering from an etcd quorum loss when I moved too many nodes at once.

The nodes/proxy GET RBAC permission allows any ServiceAccount to execute code inside any Pod in the cluster, without leaving a single trace in the audit logs. This article details the issue, how to check if you are vulnerable, the fixes to apply, and the preventive measures you can put in place if you can't patch right away.

We're wiring together three components: OpenLDAP (your user directory), Dex (the authentication translator), and the Kubernetes API Server (the skeptical consumer of identity tokens). Every bug, every misconfiguration, and every "why is this not working" moment is documented here because I hit all of them personally.

But managing multiple self-hosted runners manually can be tedious, especially in a Kubernetes environment. In this article, I'll show how I automated this process using Argo CD ApplicationSet, making my GitHub runners dynamic, declarative, and scalable.

We needed help. Not a dashboard. Not another alerting rule. An actual pair of hands that could look at an alert, check if it's real, figure out what's wrong, and either fix it or tell us where to look.

Finance had flagged the AWS bill. GPU spend for the past 30 days: $40,200. The budget was $18,000. Nobody on the call could explain where the extra $22,000 had gone.

On April 22, 2026, the Linux CNA published CVE-2026-31431, a Linux kernel vulnerability in algif_aead, the AEAD side of the kernel's AF_ALG crypto socket interface. Xint named the bug Copy Fail and showed how page-cache bytes for a read-only file can be changed without dirtying the file on disk.

This post walks through how we architected a single private container registry accessible by all six of our AKS clusters across three Azure regions. I'll cover what worked, what silently failed for weeks before we noticed, and the decisions I'd make differently today.

In this article, we'll show how to use tofu-controller to manage Terraform resources using GitOps, focusing on two real-world use cases: managing Grafana resources (dashboards, datasources, folders, alert rules) and managing HashiCorp Vault resources (policies, auth methods, roles).

Agones is a project created by Google to manage and deploy video game servers on Kubernetes.

This document provides a step-by-step guide to signing Docker images stored in Amazon ECR using Cosign and AWS KMS, enabling secure software supply chain practices in Kubernetes (EKS) environments.

piqc is a source-available inference fact collector for Kubernetes clusters. It collects model-aware facts — what is running, on what hardware, at what cost, with what waste — and surfaces them as a standardized facts bundle that feeds an optimization layer.