platform engineering · regulated EU financial services

Vid Košir

Senior OpenShift & Kubernetes Platform Engineer

I do not choose my hardware. I declare my needs.

I design and run OpenShift and Kubernetes platforms in regulated EU financial services, the kind of environment where “it works on my cluster” isn't good enough, and where an auditor eventually asks who changed what, when, and with whose sign-off.

Right now I'm leading a multi-wave migration of a large application portfolio onto on-premises OpenShift, on vSphere via user-provisioned infrastructure, owning the stack end to end: cluster architecture, the CI → registry → GitOps delivery path, least-privilege identity for internal teams and external vendors, storage, and secrets. I treat GitOps with ArgoCD as both a delivery mechanism and an audit trail, right-size against real utilisation rather than what workloads reserve, and model platform cost across multi-year subscription terms rather than committing capacity to workloads that don't exist yet. The tools below came out of that work.

Selected work

Open-source tools, each built from a real problem on the platform, not demos. The Linux Fleet Toolkit is a family of agentless SSH tools that share one transport, one inventory model, and one Excel-safety layer.

Linux Fleet · Assess

read-only, one Excel report per run

Linux · Security audit maintained

Linux Fleet Audit

Agentless auditing for Linux fleets. One read-only SSH pass per host produces a single formatted Excel report: full inventory, hardening findings ranked by severity with a recommended fix for each, and ~30 CIS-style pass/fail checks. Parallel, key- or password-based, and graceful: unreachable hosts are logged with a reason and the run carries on. Report cells are written formula-safe so a compromised host can't smuggle a payload into your spreadsheet.

Python MIT

GitHub

Linux · Config drift maintained

Linux Fleet Drift

Captures a baseline of the state you care about, then checks later runs against it and reports what moved: effective sshd config, curated sysctl, security-relevant /etc file hashes, installed packages, listening ports, users and groups. Read-only; it diffs each host against its own baseline, or against a single golden reference for fleets that should be uniform. Output is a formatted Excel report and a JSON drift report.

Python MIT

GitHub

Linux · TLS / PKI maintained

Linux Fleet Certs

Fleet-wide TLS certificate expiry scanner. Finds service and leaf certificates across the usual RHEL locations (skipping shipped CA bundles), records validity, days-left, key type and signature algorithm, and classifies each as expired, expiring, or weak. Report-only: it never renews, reissues, or writes to a target. Output is a formatted Excel report and a JSON inventory.

Python MIT

GitHub

Linux · Disk space maintained

Linux Fleet Diskspace

Fleet disk-space triage over SSH for RHEL 9 hosts. Reads hosts from a plain text file, connects with sudo, and reports disk and inode usage with the top consumers on each host. Reclaiming space (truncating logs, deleting rotated logs, vacuuming journald, clearing cache) is optional, applied only after a per-host confirmation.

Python MIT

GitHub

Linux Fleet · Remediate

changes live hosts, guarded and reversible

Linux · Remediation maintained

Linux Fleet Harden

Interactive, human-approved remediation driven by a Linux Fleet Audit plan. It re-verifies each finding on the live host, applies only the fixes you approve, backs up every file first, and supports full rollback. Its sshd guard (validate, watchdog, fresh-session check) makes it structurally impossible to lock yourself out. Dry-run by default; disruptive changes require a typed confirmation.

Python Apache-2.0

GitHub

Linux · Patching maintained

Linux Fleet Patch

Staged dnf patch management for a RHEL 9 fleet: discover pending updates, tag which carry a security advisory and its severity, and detect reboot-required state. Apply re-validates each host against live state and installs only what is still pending; opt-in reboots are serialized, one host at a time, so a bad kernel never takes the fleet down at once. A single transaction can be rolled back. Excel report plus a machine-readable plan.

Python MIT

GitHub

Linux · Accounts & access maintained

Linux Fleet Users

Account and access lifecycle for a RHEL 9 fleet. Audits local accounts, password aging, sudoers, and SSH keys, flagging duplicate UID 0, empty or never-expiring passwords, NOPASSWD grants, weak keys, and stale logins. Apply only ever locks or expires stale accounts, re-validating last login first, and never touches root, low-UID accounts, or the account you connect as. It never deletes.

Python MIT

GitHub

Linux · Firewall maintained

Linux Fleet Firewall

firewalld policy audit and reconciliation. You describe what each host may expose in a declarative policy; it reads the effective ruleset, diffs it against the policy, and reconciles the difference with per-host confirmation, flagging runtime-versus-permanent drift. An SSH lockout guard blocks any change that would drop your control access unless you force it. Excel report plus a machine-readable plan.

Python MIT

GitHub

Linux · Login banners maintained

Linux Fleet MOTD Editor

Pushes a consistent, informative login banner to every host over SSH: hostname, load, disk, pending security updates, reboot-required, and failed units, with per-host approval, backups, and rollback. It detects each distribution's MOTD mechanism instead of assuming one, holds the login-time renderer to a 50 ms budget so it never slows a shell, and guards the profile.d hook against the classic bug that silently corrupts scp and rsync across a whole fleet.

Python MIT

GitHub

Linux Fleet · Foundation

shared building blocks the others stand on

Linux · Shared core maintained

linux-fleet-common

The shared inventory model behind the Linux Fleet tools: one inventory file, read the same way by every tool. Host, group, and default layers resolve with per-value provenance, so every resolved setting records which layer supplied it, and the schema is strict: an unknown key is a load-time error, not a silent no-op. Deliberately small, because the other tools depend on it staying stable.

Python MIT

GitHub

Linux · Executor maintained

linux-apply

The shared executor for the toolkit. Each discover tool emits a plan; linux-apply turns it into a normalized action plan and runs it over SSH with one discipline: for every action, re-validate against live state first and run it only if still needed. Wired adapters cover patch, users, and firewall, each with its own live guard and defensive drops for root or the control SSH path. Standard library only, no third-party dependencies.

Python MIT

GitHub

Linux · EOL & migration

close the End-of-Life finding, with audit evidence

Linux · EOL patching maintained

centos-eol-patch

Closes the recurring scanner finding that an End-of-Life CentOS host has received no security patches. It repoints yum/dnf to the CentOS vault, installs every update published up to EOL, and packages timestamped audit evidence a reviewer can accept, gated behind a required vCenter snapshot and safe to re-run. Honest by design: it also ships a migrate-plan command, because patching a dead OS is a stopgap, not a substitute for moving to a supported one.

Bash MIT

GitHub

OpenShift & Kubernetes

platform cost, storage, access, and TLS — done honestly

OpenShift · FinOps maintained

corepair

Size OpenShift subscriptions from measured demand, and show how much of a multi-year “saving” is an enforceable contract term versus just a forecast.

$pipx install corepair

Python Apache-2.0

GitHub PyPI

Kubernetes · Storage maintained

pvdoctor

Diagnoses Kubernetes PersistentVolumes stuck in Terminating, Released, or Failed, identifies the real backend cause (orphaned vSphere snapshots, stale claimRefs, dangling volume attachments, backup finalizers, and more), and prints the safe fix next to the destructive finalizer-removal hack it talks you out of. Read-only by construction, a single static binary, with offline triage from JSON dumps.

Go Apache-2.0

GitHub Releases

Kubernetes · RBAC maintained

rbacspy

Answers “who can actually do this?” on a Kubernetes cluster and shows the exact grant path: the RoleBinding or ClusterRoleBinding, the Role or ClusterRole it points at, and the Group membership that carries it to a person. Neutral by default, reporting the facts of the RBAC graph as audit evidence; with --policy it lints against a least-privilege, GitOps-run posture, flagging cluster-admin grants, human write access, and wildcard roles by severity. Read-only.

Go Apache-2.0

GitHub

Kubernetes · TLS maintained

certwatch

Checks TLS across the whole request path: Routes, Ingresses, cert-manager Certificates, Secrets, and the certificate actually served at the public edge, then reports where they disagree before a browser does. Built for the common setup where an external load balancer terminates TLS in front of the cluster, so the edge and the cluster can drift apart. It never writes: --probe-edge only opens outbound connections to hosts already declared in your Routes, and it runs fully offline from JSON dumps.

Go Apache-2.0

GitHub

Writing

Short, practical write-ups that come out of the tools above.

28 Jul 2026

What agentless auditing actually trades away, and why coverage is a finding, not a footnote Read

An agentless SSH audit only knows what it could reach. Here's why an unreachable host isn't a null result: it's a finding of its own.

11 Jul 2026

Hardening a Linux fleet over SSH without locking yourself out Read

The riskiest part of hardening sshd isn't the CIS checklist: it's the moment you restart the daemon on a host you can only reach over the connection you're about to break.

24 Jun 2026

What a three-year OpenShift subscription “saving” is actually made of Read

A multi-year OpenShift quote bundles a real discount with a set of assumptions about your workload. Here's how to tell them apart before you sign.

View all posts