/var/log/blog

The final TrustStack retrospective, from AWS governance and runtime attacks to signed images, Kyverno enforcement, and the value of proving the denied path.

The final supply-chain test connecting signed builds to Kyverno admission, including the allowed image, the denied image, and the limits of the trust model.

A mid-build report on SBOMs, vulnerability scanning, Cosign keyless signing, Rekor, SLSA provenance, and the admission-control work still missing.

The plan for proving where a container image came from, what it contains, and whether Kubernetes should allow it to run.

How PontoAntiCrack moved through dry-run, real event capture, bounded remediation, circuit-breaker testing, and its handoff to ProvenancePipeline.

A mid-project look at the detection pipeline, negative fixtures, circuit breaker, S3 policy ambiguity, and the gap between documented events and real AWS behavior.

The design for an AWS detection and response system that plans first, preserves evidence, limits its own authority, and starts without changing resources.

The final KateClusters results across control-plane hardening, RBAC, Pod Security, NetworkPolicy, runtime detection, and four controlled attack scenarios.

A practical update from the hardening phase, covering the CIS baseline, audit policy, encrypted Secrets, Calico, RBAC, Falco, and a cluster that briefly lost DNS.

Why I chose kubeadm for the Kubernetes part of TrustStack, what the single-node lab can prove, and why the first benchmark must happen before hardening.

A retrospective on completing the six AwLZ Terraform stacks, validating the guardrails and log archive, and handing the next part of TrustStack to KateClusters.

A mid-build report on AwLZ, including Terraform state, multi-account logging, delegated security services, and SCPs that blocked their own deployment path.

The first TrustStack build log, covering the scope, account structure, Terraform bootstrap, and failure modes I want AwLZ to address.

The reasoning behind TrustStack, the four projects inside it, and my decision to learn by building, breaking, and verifying the controls myself.

how I made a FullStack banking/payment plan managment and creation application

Ten weeks of mystery outages, three stacked root causes, and the security doctrine that came out of running a real production workload on hardware I own.

How Revista BRASILCON runs on hardware I own, serves readers worldwide, and exposes not a single inbound port to the internet.

A case study from my work automating Hyundai's new-hire onboarding flow. Some implementation details are generalized to respect confidentiality.

the Lates and Greatest of the first month (and week) of 2026

the biggest hurdles, and how i got over them

why i decided to start this blog, and how