The k3s Home Lab, Part 4: Ephemeral GitHub Actions Runners with ARC
Connecting GitHub Actions, ARC, a private Gitea registry, and Flux into a scale-to-zero delivery pipeline for a journaling application.
Read postBlog
Engineering notes from the security edge.
Long-form technical writing on cybersecurity architecture, cloud security, infrastructure, automation, and the messy parts of operating controls in the real world.
The k3s Home Lab, Part 3: Closing the Loop with Flux
Moving from a working Kubernetes cluster to a reproducible one: bootstrapping Flux, structuring reconciliation, handling secrets, and learning to treat Git as the control plane.
Read postThe k3s Home Lab, Part 2: From Compose to Reconciliation
A practical migration story about translating containers into Kubernetes workloads without confusing orchestration with resilience.
Read postThe k3s Home Lab, Part 1: Small Cluster, Real Architecture
Why I chose k3s, how the control plane, networking, ingress, storage, and Proxmox failure domains fit together, and what I would design first next time.
Read postPutting a Guardrail on Traefik: Docker Discovery Without the Raw Socket
Building the original Docker and Traefik deployment around automatic discovery while reducing the risk of mounting the Docker daemon socket directly.
Read postAI Governance for Agentic Systems, Part 3: Implementing Controls in the Microsoft Stack
Agentic AI governance becomes real when Purview, Power Platform, Entra ID, SIEM monitoring, and data governance are wired into enforceable identity, DLP, and behavioral controls.
Read postAI Governance for Agentic Systems, Part 2: Microsoft's Agentic Lifecycle Problem
Microsoft's Copilot stack makes agent building accessible, but enterprise governance has to balance citizen development with identity, lifecycle, data, connector, and oversight controls.
Read postAI Governance for Agentic Systems, Part 1: ATF and MAESTRO
Agentic AI needs more than policy language. This post introduces MAESTRO for threat modeling and the Agentic Trust Framework for zero trust controls, autonomy gates, and enterprise-ready guardrails.
Read postStop Filtering URLs. Start Controlling Applications.
A practical Palo Alto Networks policy guide on moving from brittle URL-only rules toward App-ID, SSL decryption, security profile groups, application groups, and least-privilege enforcement.
Read postDeploying Enterprise NAC: Real-World Challenges and a Technical Look at Forescout vs. FortiNAC
Enterprise NAC is less a product installation than a multi-domain engineering program. This post walks through visibility, enforcement, 802.1X, exceptions, segmentation, operations, and where Forescout and FortiNAC each fit.
Read post