I read the whole of Regulation (EU) 2024/2847, every article and every annex, and mapped KubeAid and LinuxAid against it for my employer. These are the things that surprised me, the mental model I ended up with, and what I would tell the next engineer who has to do the same reading.
How I put Keycloak login in front of Prometheus, Alertmanager, the Traefik dashboard and other UIs with no login of their own: what Traefik's forwardAuth sends and does with the answer, the Middleware and annotation that make up the integration, and the ClusterRoles of URL patterns that decide which group sees which hostname.
Why the servers I manage authenticate to services in Kubernetes with the certificate their Puppet agent already holds: the Traefik TLSOption and CA Secret, RequireAndVerifyClientCert versus VerifyClientCertIfGiven, the passTLSClientCert header the app reads, and the seven months a stale CA bundle rejected every server without anyone noticing.
Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.
A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters.
Deploying CISO Assistant via Helm, creating your first superuser, adding users, and how evidence storage actually works.