I read the whole of Regulation (EU) 2024/2847, every article and every annex, and mapped KubeAid and LinuxAid against it for my employer. These are the things that surprised me, the mental model I ended up with, and what I would tell the next engineer who has to do the same reading.
Processes and signals, namespaces and cgroups, memory, storage, networking, and identity: the mechanism behind each, the two or three ways it breaks under a pod, and the one check that confirms it. Written from on-call across 100+ production Kubernetes clusters.
Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.
Deployment mode, object storage, label cardinality, multi-tenancy and auth, cross-cluster shipping, and the failures that are silent rather than loud. Written after moving a Loki install twice and debugging an object store that corrupted everything it was given.
A breakdown of why DaemonSets using hostPort can get stuck in Pending during rolling updates, and why the default maxSurge/maxUnavailable settings aren't always right for them.
A breakdown of the Model Context Protocol - the problem it solves, its architecture, and how a tool call actually works under the hood.
What a PodDisruptionBudget actually does, the difference between voluntary and involuntary disruptions, how the eviction API respects it, and the mistakes that quietly break node drains and cluster upgrades.
A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters.
Deploying CISO Assistant via Helm, creating your first superuser, adding users, and how evidence storage actually works.
A few GNOME extensions that genuinely improved my Ubuntu desktop experience, from useful clipboard history to ridiculous window-burning animations.