Blogs

What an agent harness actually is, where the word comes from, and the dozen or so primitives hiding inside the term. A companion to the loop engineering post.

What eBPF actually is, why the verifier means it can't crash your kernel, hooks and maps in plain words, two runnable examples with bpftrace and libbpf, and how Cilium turns all of it into a CNI.

What loop engineering actually means, where the term came from, and how /loop and /goal turn Claude Code into something that babysits deployments and works until the tests pass.

Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.

Deployment mode, object storage, label cardinality, multi-tenancy and auth, cross-cluster shipping, and the failures that are silent rather than loud. Written after moving a Loki install twice and debugging an object store that corrupted everything it was given.

A breakdown of why DaemonSets using hostPort can get stuck in Pending during rolling updates, and why the default maxSurge/maxUnavailable settings aren't always right for them.

A breakdown of the Model Context Protocol - the problem it solves, its architecture, and how a tool call actually works under the hood.

What a PodDisruptionBudget actually does, the difference between voluntary and involuntary disruptions, how the eviction API respects it, and the mistakes that quietly break node drains and cluster upgrades.

A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters.

Deploying CISO Assistant via Helm, creating your first superuser, adding users, and how evidence storage actually works.