Security

~/posts/agent-sandbox 19 min · 3912 words

$ Agent Sandbox - Kubernetes-Native Sandboxes for AI Agent Code Execution

// A hands-on tour of agent-sandbox, the Kubernetes SIG Apps project for isolated, stateful, singleton workloads built for AI agent runtimes. Includes a Go agent with sandboxed tools on Kind, warm pools claiming in 53ms, Flux GitOps, and the gotchas the docs don't mention.

~/posts/choragos-multi-agent-orchestrator 26 min · 5350 words

$ Choragos - Running a Team of Coding Agents Without Losing Control

// Choragos runs a team of AI coding agents with a real division of labour: an orchestrator that plans and delegates, workers with their own context, model and credentials, and a delegate/work-done protocol carrying work between them. A walkthrough of v0.11.2 with config recipes for real teams.

~/posts/introducing-sphragis-eu-ai-act-compliance-gateway 17 min · 3410 words

$ Sphragis - The EU AI Act Compliance Gateway You Actually Control

// Sphragis is a self-hosted Go gateway that strips PII out of every LLM request and response before it leaves your network and writes a tamper-evident, hash-chained audit log. A walkthrough of the v0.3.0 release: local redaction, reversible tokenization, multi-provider routing, and OpenTimestamps anchoring.

~/posts/kubernetes-agent-with-google-adk-go 12 min · 2453 words

$ Building a Read-Only Kubernetes Agent with Google ADK (Go)

// How to build a safe, read-only Kubernetes operations assistant in Go using Google's Agent Development Kit, packaged in a scratch image and deployed via Helm with External Secrets Operator.

~/posts/dapr 20 min · 4245 words

$ Dapr - Building a Safe Platform for Citizen Developer Apps on Kubernetes

// How to use Dapr, Flux, Harbor, and a shared Helm chart to safely host apps built by non-technical citizen developers using LLMs on Kubernetes.

~/posts/oauth2-proxy 21 min · 4283 words

$ OAuth2-Proxy - Securing MCP Servers on Kubernetes Before Hackers Find Them First

// MCP servers like DBHub expose databases, filesystems, and code execution over HTTP with zero authentication. Learn how to deploy OAuth2-Proxy on Kubernetes to add SSO, group-based access control, and session management to any MCP server without changing a single line of code.

~/posts/k8s-multi-tenancy 21 min · 4444 words

$ Building a Multi-Tenancy Platform with Capsule and vCluster - Hard vs Soft Isolation

// Learn how to build secure, scalable multi-tenant Kubernetes platforms using Capsule for namespace-based isolation and vCluster for virtual cluster deployment. Compare architectures, explore production use cases, and implement cost-effective multi-tenancy patterns with practical examples and complete demos.

~/posts/tetragon 10 min · 2101 words

$ Cilium Tetragon - Next-Generation Runtime Security for Kubernetes

// Explore Cilium Tetragon, an eBPF-based security observability and runtime enforcement platform that provides kernel-level protection for Kubernetes workloads with minimal overhead.

~/posts/istio-ambient-mesh 4 min · 785 words

$ Simplifying Kubernetes Service Mesh - A Deep Dive into Istio Ambient Mesh

// A comprehensive guide to Istio Ambient Mesh, exploring its sidecar-less architecture, performance benefits, and practical implementation steps. Learn how zTunnel and Waypoint Proxy revolutionize service mesh deployment while reducing resource overhead.

~/posts/kubernetes-security-with-kubescape 3 min · 585 words

$ Embracing Enhanced Kubernetes Security with Kubescape

// Discover how Kubescape enhances Kubernetes security and compliance.

posts tagged #Security