§00/Writing

Field notes from
the sovereign stack

Long-form, deeply technical writing for engineers who run what they own — Kubernetes security, Talos Linux, cloud repatriation, self-hosted AI, supply-chain integrity, and the audit-grade rigor that makes self-hosting safe in serious environments.

FinOpsSecurityStreamingSovereign AIComplianceSovereigntyBare MetalMulti-TenancyDataCI/CDIdentityStorageResilienceKubernetesObservabilityProgressive DeliveryInfrastructureCloud ExitSupply ChainGovernanceGitOpsNetworkingPlatform Engineering

§01/Latest

Showing 1–9 of 40

FinOps

Kubernetes Cost Allocation: OpenCost Namespace Showback to Chargeback

Namespace-level Kubernetes cost allocation with OpenCost: run showback and graduate to chargeback on bare-metal clusters where no cloud billing API exists.

21 Jul 202613 min read

Security

Your Own ACME: Sovereign Internal PKI with step-ca and cert-manager

Run a self-hosted certificate authority for internal Kubernetes names: step-ca as a private ACME server, cert-manager as the client, no CT-log leakage.

20 Jul 202613 min read

Streaming

Self-Managed Kafka: Strimzi, Redpanda, NATS Off Confluent Cloud

A production ops playbook for a self-owned event backbone: Strimzi's Kafka lifecycle on Kubernetes, Redpanda's single binary, and NATS — off Confluent Cloud.

19 Jul 202613 min read

Sovereign AI

Sharing the GPU: MIG vs Time-Slicing for Mixed Inference on Kubernetes

MIG gives hard, isolated GPU partitions; time-slicing shares one context with none; DRA makes fractional GPU scheduling a first-class Kubernetes primitive.

18 Jul 202613 min read

Sovereign AI

The Sovereign AI Gateway: LiteLLM, MCP, and Agent Data Residency

Model residency is not agent residency. A self-hosted MCP gateway and LiteLLM proxy keep tool-calls, keys, and PII inside your own network boundary.

17 Jul 202613 min read

Compliance

Schrems II, Six Years On: EU Data on US Clouds Is Still Unsafe

Schrems II turns six today. The EU-US Data Privacy Framework is under fresh challenge, and CLOUD Act reach means US-parent clouds remain a live transfer risk.

16 Jul 202613 min read

Sovereignty

European Sovereign Cloud: Build, Buy, or Self-Host Framework

European sovereign cloud is three options, not one: hyperscaler region, EU-incorporated provider, or self-host — scored on control, jurisdiction, lock-in, cost.

15 Jul 202612 min read

Sovereignty

Digital Sovereignty: From Policy Slogan to Testable Architecture

Digital sovereignty is not a slogan but five engineering control layers — compute, data, keys, identity, supply chain — each mapped to a testable control.

14 Jul 202613 min read

Sovereignty

Gaia-X in Practice: Federation, Labels, and the Sovereignty Gap

Gaia-X gives European cloud services a machine-verifiable trust layer — but not control-plane custody, key ownership, or immunity from foreign jurisdiction.

9 Jul 202613 min read

§00 / WRITING

Executive Briefing

Thirty minutes to clarify your infrastructure risk

Walk us through your vendor footprint and regulatory constraints. We will tell you honestly where sovereignty creates leverage — and where it does not. No pitch deck. No obligation.

Book an executive briefing How we engage