All Series
Infrastructure security and platform engineering — practitioner-written, practitioner-depth.
Each series is a complete curriculum: a structured sequence of posts that builds understanding from first principles to production-grade depth. Not a collection of loosely related articles.
At a Glance
| Series | Track | Episodes | Status |
|---|---|---|---|
| eBPF: From Kernel to Cloud | Kernel & Observability | 14 of 18 | Active |
| Kubernetes Ecosystem | Kubernetes & Platform | 9 of 10 | Active |
| Kubernetes: From Borg to Platform Engineering | Kubernetes & Platform | 8 of 8 | Complete |
| Kubernetes CRDs & Operators | Kubernetes & Platform | 10 of 10 | Complete |
| Cloud IAM: From Zero to Master | Identity & Access | 13 | Ongoing |
| The Identity Stack: LDAP to Zero Trust | Identity & Access | 13 of 13 | Complete |
| Identity in the Agentic Era | Identity & Access | 3 of 6 | Active |
| OS Hardening as Code | OS & Hardening | 6 of 6 | Complete |
| Immutable OS | OS & Hardening | 2 of 6 | Active |
| Purple Team Playbook | Offense & Defense | 13 of 13 | Complete |
| Cybersecurity Architecture Masterclass | Offense & Defense | 6 of 6 | Complete |
| OWASP LLM Top 10 | AI & LLM Security | 7 of 22 | Active |
| The Legible Repo | Engineering Practice | 1 of 13 | Active |
Kernel & Observability
eBPF: From Kernel to Cloud · 14 of 18 · Active
How Cilium, Falco, and Tetragon actually work at the kernel level. For SREs, platform engineers, and security practitioners running Kubernetes who want to understand what eBPF-based tools are doing — not just how to deploy them.
Weekly, Tuesdays. Start with EP01: What Is eBPF? →
Kubernetes & Platform Engineering
Kubernetes Ecosystem: From User to Contributor · 9 of 10 · Active
MicroK8s, Minikube, Rancher, Cluster API, Crossplane, Karpenter, KubeVirt — profiled the way their own maintainers would explain them, then pushed one step further into where each tool actually falls short and what a real contribution there would look like.
Start with EP01: MicroK8s Explained →
Kubernetes: From Borg to Platform Engineering · 8 of 8 · Complete
How Kubernetes went from Google’s internal Borg system in 2003 to the substrate for platform engineering in 2025. Covers the container wars, CNCF donation, RBAC adoption, the operator pattern, PSP deprecation, dockershim removal, eBPF integration, GitOps, and what shipped in v1.33–v1.35.
Start with EP01: The Borg Legacy →
Kubernetes CRDs & Operators: Extending the API · 10 of 10 · Complete
From what a CRD is through building a production operator with kubebuilder. Covers CRD schema, CEL validation, the controller reconcile loop, versioning with conversion webhooks, admission webhooks, and production patterns for finalizers and status conditions.
Start with EP01: What Is a Kubernetes CRD? →
Identity & Access
Cloud IAM: From Zero to Master · 13 episodes · Ongoing
AWS, GCP, and Azure access control from first principles to privilege escalation defense and Zero Trust architecture. Covers the deny-by-default model, cross-cloud IAM patterns, federation, and the attack paths through IAM that security teams need to know before an attacker finds them. The core curriculum is complete; new episodes land as new cloud services ship new permissions.
Start with EP01: What Is Cloud IAM? →
The Identity Stack: From LDAP to Zero Trust · 13 of 13 · Complete
Enterprise authentication from the ground up: how LDAP was invented, how Kerberos works, what SSSD actually does on every Linux login, Active Directory internals, SAML and OIDC, and how to log into a Linux VM with Entra ID credentials. For Linux administrators and infrastructure practitioners who have used these tools but never had the full picture explained.
Start with EP01: What Is LDAP? →
Identity in the Agentic Era · 3 of 6 · Active
AI agents are non-human identities, and most teams are repeating every IAM anti-pattern from the cloud-native era — faster, with actors that are autonomous and manipulable. Covers RAG access control, OIDC workload identity for LLM pipelines, and zero trust for agentic architectures.
Start with EP01: The Non-Human Identity Problem Is Back →
OS & Infrastructure Hardening
OS Hardening as Code · 6 of 6 · Complete
Declarative OS hardening: declare your Linux security baseline in YAML, build it reproducibly across any cloud provider, get an automated compliance grade before deployment, and block unhardened images from reaching production. Built around BakeX, an open-core (Apache 2.0) hardening platform.
Start with EP01: Cloud AMI Security Risks →
Immutable OS: From Hardened Image to Self-Healing Infrastructure · 2 of 6 · Active
The sequel to OS Hardening as Code: read-only root filesystems, atomic A/B image updates, and one-command rollback — for engineers who’ve hardened an image and want it to stay that way after boot #10,000. Covers ostree, bootc, Fedora CoreOS/Silverblue, and Talos Linux.
Start with EP01: What Is an Immutable OS? →
Offense, Defense & Architecture
Purple Team Playbook: Cloud, Kubernetes, and Linux Attack Paths · 13 of 13 · Complete
Red attacks, Blue detects, Purple defends. Real breach anatomy — MFA fatigue at Uber, SSRF at Capital One, SolarWinds and XZ Utils — mapped to OWASP Top 10 and turned into detection rules and defense-in-depth you can actually deploy. Ends with a cloud incident response playbook and a repeatable way to run these simulations against your own infrastructure.
Start with EP01: What Is Purple Team Security? →
Zero to Hero: Cybersecurity Architecture Masterclass · 6 of 6 · Complete
Resilient, identity-centric security architecture from first principles: dismantling the castle-and-moat model, STRIDE threat modeling, hardening the AWS identity perimeter, surviving ransomware with immutable data, AI-assisted SecOps, and continuous validation.
Start with Module 1: Cybersecurity Architecture Principles →
AI & LLM Security
OWASP LLM Top 10: From Web Roots to AI Frontiers · 7 of 22 · Active
How OWASP’s classic assumptions — deterministic behavior, parseable input, enumerable permissions — break down for LLM applications, and what the OWASP LLM Top 10 (2025) actually requires. Written by an infrastructure security architect, not an ML researcher.
Start with EP01: OWASP Top 10 History →
Engineering Practice
The Legible Repo: Product Quality for Humans and AI Agents · 1 of 13 · Active
The quality layer your CI can’t see: whether a stranger arriving cold — human or AI agent — can go from “found the repo” to “it worked on my machine” in ten minutes. Runs in three parts: the doctrine for maintainers, extending the gate for collaborators, and adopting it at scale for enterprises. Built around Invigil, an Apache-2.0 CI gate that grades repos on the promises strangers rely on.
Weekly, Thursdays. Start with EP01: Product Quality vs Code Quality →
Get new episodes by RSS or email → subscribe