Field notes from
the sovereign stack

SPIFFE/SPIRE issues cryptographic, attested workload identity — X.509 and JWT SVIDs — so Kubernetes services get mutual TLS and zero long-lived static secrets.

The EU AI Act, NIS2, and DORA are one architecture constraint, not three checklists — the technical evidence for why hyperscaler SaaS cannot satisfy them.

How to replace Datadog and New Relic with a self-hosted OpenTelemetry + Prometheus + Loki + Tempo + Grafana stack on Kubernetes — retaining data sovereignty, audit-grade retention, and eliminating per-GB ingestion costs.

Canary and blue-green on Kubernetes with Argo Rollouts: metric-driven AnalysisRuns, automated rollback, Gateway API traffic shaping, and audit-grade promotion gates.

In our engagements, a base Ubuntu 22.04 install consistently shows 40–50x more critical/high CVEs than an equivalent Talos Linux node. Here is the structural reason the gap exists — and why retrofitted hardening cannot close it.

A no-hype engineering playbook for cloud repatriation: dependency audit, stateful workload classification, TCO model, and why ~70% of attempts fail within 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.

A complete guide to building a Kubernetes supply chain security pipeline: SBOM generation with Syft, SLSA L3 provenance via slsa-github-generator, Sigstore keyless signing, and Kyverno admission enforcement.

Policy lifecycle — versioning, testing, exceptions, reporting — is 80% of the problem. Here is how to build a Kyverno governance layer that scales organizationally.