Persist Vault audit logs on the host: permissions, HUP, and 90-day rotation
Configure the audit device, container storage, and logrotate separately, then verify that new requests reach the new file after rotation.
Tag · 6 stories
#security
→
Distribute Registry credentials across namespaces with ClusterExternalSecret
Keep the credential in Vault, select namespaces with labels, and verify both Secret delivery and real image pulls.
Helping AI Understand My Kubernetes Infrastructure
I use my GitOps repository as shared working notes, so AI can understand the current setup before helping with changes, validation, and writing.
A Kubernetes MCP Tool That Can Look but Not Touch
Restricting AI access to SSH, Kubernetes, and OpenTelemetry diagnostics while keeping local LLM context small.
Replace Caddy with cloudflared: expose Kubernetes without opening ports 80 and 443
Move the public entry point and identity checks to Cloudflare, then reach internal services through an outbound-only Tunnel.
Remove an accidentally committed secret from Git—locally and remotely
Deleting the file is only the first step: rotate the credential, rewrite every reachable ref, verify the remote independently, and prevent the next …