Field notes from
the sovereign stack
Page 10

Progressive delivery on Kubernetes with Argo Rollouts: metric-driven AnalysisRuns, automatic rollback, Gateway API traffic shaping, audit-grade promotion.

The Grafana stack — OpenTelemetry, Prometheus, Loki, Tempo — against Datadog and Elasticsearch: sovereign telemetry on Kubernetes with no per-GB ingestion bill.

Talos Linux vs Ubuntu for Kubernetes security: an immutable, API-only node ships almost no userspace to carry CVEs, and hardening Ubuntu cannot close that gap.

A no-hype cloud repatriation playbook for Kubernetes: dependency audit, stateful workload triage, a real TCO model, and why most attempts fail inside 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.

Kubernetes supply chain security end to end: SBOMs with Syft, SLSA L3 provenance, Sigstore keyless signing, and Kyverno admission control that actually blocks.

Kyverno against OPA Gatekeeper on Kubernetes, then the lifecycle nobody budgets for: versioning, testing, exceptions and reporting are 80% of the work.

Multi-cluster GitOps past 20 clusters: where Argo CD's hub saturates, where Flux shifts that cost onto your Git origin, and the load model to find your ceiling.

Vault is the right backend, not the right interface. ESO + dynamic credentials + etcd encryption eliminate long-lived secrets from Kubernetes clusters.