Posts

the boy in the cap kneeling on a floating stone island, laying a single arched bridge across to another island; behind them a brick wall with one small gate, the robot standing on the far side, and broken bridge pieces discarded to the right

🛡️ How Do You Prevent a Compromised Pod From Calling Your Database?

Default Kubernetes is a flat network. Every pod can reach every other pod. In a cluster with ten services, that’s ten potential blast radiuses instead of one.

the boy in the cap dropping a code card into a slot in a small git-marked box, which is joined by a single hose to a larger cube marked with the git and Kubernetes symbols; the robot watches from the left

🔑 Deploy to Kubernetes Without Storing Any Cluster Credentials in CI

A common interview question in 2026. If your answer is ‘kubeconfig in a CI secret’, you’re not wrong — but you’re also not getting the job.

the robot turning a key in the dial of a large safe door marked with a cloud, drawing a small scroll out along an arrow toward the boy in the cap, who holds an open cardboard box marked with a padlock ready to receive it

🤫 How Do You Handle Secrets in a GitOps Repository?

GitOps says Git is the source of truth. Secrets say don’t put them in Git. These two things appear to be in direct conflict. They’re not.

two winding paths leading to one server cabinet with its door open — the robot walking up the left path holding a key past a pi symbol, the boy in the cap walking up the right path holding a padlock past a cloud

🔐 Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

No open ports. Real TLS at home. One IngressRoute per app. This is the networking setup I landed on after ruling out everything that required a compromise.

the boy in the cap plugging a network cable into a server rack while the robot stands beside him holding a small server box in both hands, eyes closed and grinning

🏗️ My Homelab Runs on GitOps. Here's What That Actually Means.

I wanted to learn production-grade Kubernetes patterns without breaking production. One node, a full GitOps stack, and a hard rule: no manual kubectl after bootstrap.

the boy in the cap holding a phone showing a GitLab sign-in screen with a Continue button, a small ticket marked with a key travelling along an arrow from the phone to a QR code on the robot's chest, the robot's antenna lighting up

📱 Building a QR Code Login for a Homelab (And Learning oauth2-proxy's Session Format the Hard Way)

My homelab uses oauth2-proxy for GitLab SSO. I wanted a QR code login for the TV dashboard. Two days and four complete rewrites later, I knew more about oauth2-proxy’s session format than I ever planned to.

the robot holding up an unrolled scroll covered in icons — a house with a wifi symbol, a server rack, a padlock — while the boy in the cap sits cross-legged holding a second, completely blank scroll

I Inherited a System With No Map. So I Drew Two.

How I turned a tribal-knowledge handover into a two-track learning roadmap — one track for the technology, one for our system, designed to interleave.