Blogs

• August 11, 2026 Letting Claude loose on an AWS account with Prowler Running Prowler across an AWS account with an agent, a read-only role, and a bastion — then triaging 1,684 findings. 8-minute read · AwsSecurityProwlerAiAutomation
• July 7, 2026 Wrapping Kyverno policies into a chart you can actually tune Turning a pile of static ClusterPolicy manifests into a Helm chart with three tiers of configurability. 9-minute read · KyvernoHelmKubernetesSecurityGitops
• June 16, 2026 Karpenter consolidation without the pager fatigue Tuning consolidation and spot interruption handling so the alerting channel stays worth reading. 5-minute read · KarpenterAwsEksSpotCost-Optimization
• June 2, 2026 IRSA to Pod Identity: notes from the migration Migration notes, the annotation that becomes a lie, and the host port 80 conflict that took down ingress. 7-minute read · AwsEksIamKubernetesSecurity
• May 19, 2026 Terragrunt: deleting the boilerplate you were told to write Hoisting version pins, generating providers, and deriving config from paths to shrink leaf units. 5-minute read · TerragruntTerraformIacAws
• May 5, 2026 A FluxCD repo layout that survives forty applications A GitOps repository structure that stays navigable past forty applications and several clusters. 4-minute read · FluxcdGitopsKubernetesKustomize
• April 21, 2026 EKS Access Entries: one ARN, one cluster, no sharing Access entries are scoped per cluster, not shared. Three ways to collide with one, and how to dedupe in Terraform. 4-minute read · AwsEksTerraformIamSecurity
• April 7, 2026 Fargate profiles and the art of waiting your turn EKS allows one Fargate profile mutation at a time. Here's why your destroy fails and how depends_on fixes it. 4-minute read · AwsEksTerraformFargate
• March 4, 2026 Node labels for Node Exporter alerts Threading an env label from a Karpenter NodePool through Kyverno into Prometheus alerts. 4-minute read · KubernetesPrometheusKyvernoKarpenterObservability
• July 15, 2025 Cutting the EKS bill: what actually moved the needle What actually moved the needle on an EKS bill, ranked by return per hour of effort. 5-minute read · AwsEksCost-OptimizationKarpenter
• October 6, 2023 Yet another Vault story Running Hashicorp Vault the GitOps way with Bank-Vaults: secret injection, probes, and Raft snapshots. 4-minute read · VaultSecurityKubernetesGitops
• September 29, 2023 Azure Pipelines YAML validation: full throttle Validating a shared Azure Pipelines YAML template repo on every PR, using the PreviewRun API. 8-minute read · Azure-DevopsCi-CdYamlAutomation
• May 26, 2023 My First Post: Warp the Terminal Why Warp replaced iTerm2 on my workstation, and the features that made it stick. 2-minute read · ToolsTerminalProductivity