Blog
Field notes on Kubernetes, security, autonomous development and observability — the problems behind ICE, deusex and KubeMeridian, and the fixes I ship for them. Subscribe via RSS.
Live needs evidence: how ICE keeps its own feature list honest
A security product that promises to call the unverified unverified has to apply the rule to itself. Five capability statuses, a dated evidence mark that CI enforces, and the five rows that lost their live status the day after the gate landed.
Merged is not deployed, deployed is not fixed
Why ICE closes a security finding only on a measurement taken after the merge — and how Argo CD's sync revision, freshness cadences and Unknown-as-unmet keep the loop honest.
The bottleneck is the human: a week when every agent worked and nothing shipped
An autonomous development loop where every role behaved as designed — and two green one-line fixes waited six days. Why refusals by category never expire, and what deusex changed.
What I haven't handed to the machine yet
deusex runs most of my backlog around the clock; the goal is that I decide only the concept. As of October 2026, here is the honest remainder — what is solvable and just not done, and what no method will ever take off a person.
From 10+ Kubernetes clusters to 4: a hub-and-spoke ArgoCD story
How we consolidated 10+ Kubernetes clusters across four clouds into four, under one hub-and-spoke ArgoCD control plane — topology, GitOps layout and the gotchas.
Vault HA on Kubernetes: auto-unseal, dynamic secrets, and a DR runbook
A production-minded HashiCorp Vault setup on Kubernetes — HA storage, auto-unseal via cloud KMS, Kubernetes auth, dynamic secrets and a disaster-recovery runbook.
Want to compare notes? See About.