$ cat ~/blog/*
Thoughts on software engineering, infrastructure, and the tools I use. I write about what I learn to solidify my understanding and help others.
Running a security audit on my Kubernetes cluster revealed some uncomfortable truths. Here is what I learned about CIS Benchmarks, Pod Security Standards, and why your kubeconfig is probably world-readable too.
I handed my homelab to Claude Code—skills, MCP servers, automated diagnostics, phone deployments. The productivity gains were real. So are the questions about what this all means.
How I built a controller that watches for cluster drama (CrashLoopBackOff, OOMKilled, the usual suspects) and tattles to an LLM for automated remediation. Because apparently I want AI to fix my 3am problems.
How I added semantic code search to my portfolio using pgvector, OpenAI embeddings, and a healthy dose of trial and error
The messy journey from timestamp chaos to semantic versioning with automated releases, changelogs, and a workflow that actually makes sense (most days)
How I built a real-time Kubernetes metrics dashboard that lets visitors delete pods and watch self-healing in action. Covers Prometheus integration, SSE streaming, secure RBAC, and the engineering behind controlled chaos.
A beginner's journey building a production-grade GitOps pipeline with ArgoCD, and the lessons that translate to real-world infrastructure
How I learned that every kubectl command involves a sophisticated cryptographic handshake (and why that's actually pretty cool)
A journey through control loops, watch streams, and custom resources—discovering how Kubernetes actually stays in sync with itself, and why controllers are the real MVPs of the platform.
How I ditched vendor annotations and discovered a cleaner way to route traffic in Kubernetes—and why you should care
A journey through systemd, systemctl, and D-Bus—discovering why restarting nginx works so differently from running it manually, and what all those mysterious *ctl commands actually do.
My journey from "surely I can just base64 encode it" to actually securing Kubernetes secrets in a GitOps workflow - complete with the paranoia that keeps me backing up keys.
I went down the rabbit hole of understanding how Tailscale actually works—from WireGuard protocol magic to NAT traversal wizardry to making your Kubernetes cluster talk over encrypted tunnels