I read the whole of Regulation (EU) 2024/2847, every article and every annex, and mapped KubeAid and LinuxAid against it for my employer. These are the things that surprised me, the mental model I ended up with, and what I would tell the next engineer who has to do the same reading.
Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.
A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters.
Deploying CISO Assistant via Helm, creating your first superuser, adding users, and how evidence storage actually works.