Writing

All posts

Short, practical write-ups that come out of the tools above and the platform work behind them.

28 Jul 2026

What agentless auditing actually trades away, and why coverage is a finding, not a footnote Read

An agentless SSH audit only knows what it could reach. Here's why an unreachable host isn't a null result: it's a finding of its own.

11 Jul 2026

Hardening a Linux fleet over SSH without locking yourself out Read

The riskiest part of hardening sshd isn't the CIS checklist: it's the moment you restart the daemon on a host you can only reach over the connection you're about to break.

24 Jun 2026

What a three-year OpenShift subscription “saving” is actually made of Read

A multi-year OpenShift quote bundles a real discount with a set of assumptions about your workload. Here's how to tell them apart before you sign.

7 Jun 2026

Why removing a PV finalizer strands your disk, and what to do instead Read

Patching away a stuck PersistentVolume's finalizer looks like it worked. It didn't: it just stopped Kubernetes from telling you the disk is still there.

21 May 2026

GitOps was sold as a delivery mechanism. In a regulated environment, the audit trail is the point. Read

ArgoCD's real value in a regulated platform isn't that it deploys things: it's that every change has a name, a timestamp, and a diff attached to it.

4 May 2026

Shared service accounts are the fastest way to lose an access review Read

The moment two people, or two organizations, share one identity into a cluster, every access question about it gets a two-part answer nobody can give quickly.