§02/Open Source as Method
The discipline, not the license
Open source is a practice of independent review, upstream contribution, and earned independence — not a category to tick on a vendor evaluation checklist. It is how sovereignty stays real after the engagement ends.
§02/OSS-AS-DISCIPLINE
Why the license is the least interesting part
Proprietary software creates invisible dependencies: you cannot inspect the code that runs your perimeter, you pay per-seat ransom to keep using it, and your exit costs grow with every year of lock-in. Open source inverts that structure — not automatically, but when practiced as a discipline.
Practiced means: reading the source before adopting a dependency. Contributing fixes upstream rather than patching in private forks. Choosing foundations that have active maintainer communities and documented upgrade paths. Designing stacks so any layer can be replaced without rebuilding everything adjacent to it.
It also means owning the supply chain. Software composition analysis, signed artifacts (Sigstore / cosign), reproducible builds, and SBOM generation are not compliance theater — they are the audit trail that makes self-hosting defensible to your board, your auditors, and your customers.
The result is infrastructure you can inspect, repair, extend, and exit. That is the engineering-sovereignty definition of open source: not freedom in the abstract, but a concrete set of practices that keep your options open.
Pillars expressed
§01 SOVEREIGNTY§02 OSS-AS-DISCIPLINE§04 EXIT-RAMPS-DESIGNED-INSoftware Bill of Materials
Every build produces a machine-readable inventory of dependencies. Auditors and security teams can enumerate the full transitive closure of what ships.
Signed artifacts
Container images and release binaries are signed at publish time and verified at deploy time. Provenance is verifiable without trusting the distribution channel.
Build provenance
Supply-chain Levels for Software Artifacts: reproducible builds pinned to a specific commit, built in a hermetic environment, with a verifiable attestation chain.
Composition analysis
Automated scanning of every dependency for known CVEs — integrated into CI so vulnerabilities surface before they reach a release branch, not after.
§02/The Stack We Operate
Real tools, not vendor slide decks
These are the open-source projects we deploy, operate, and contribute to. Not a marketing stack slide — a working inventory, grouped by layer.
Every project in this list is in active production use — not aspirational inventory.
FLAGSHIP · OPEN SOURCE
KubeVigil
Know your clusters before attackers do.
KubeVigil is a Kubernetes Security Posture Management (KSPM) CLI tool that scans clusters and YAML manifests for security misconfigurations. It runs 110 security checks across 12 categories, maps every finding to industry compliance frameworks, and outputs reports in 8 formats — from colored terminal text to SARIF for GitHub Security.
v1.5.0 released 2026-07-06last commit 2026-07-06actively maintained
Compliance mappings
CIS Kubernetes Benchmark v1.8MITRE ATT&CK v14NSA/CISA Kubernetes Hardening v1.2Scanning
# Scan manifests (no cluster needed)
kubevigil scan -f ./manifests/
# Scan a live cluster
kubevigil scan
# Filter by severity — only HIGH findings
kubevigil scan --severity high
# Output as HTML report
kubevigil scan -f ./manifests/ -o report.htmlAuto-remediation
# Preview auto-fixes (dry-run — nothing is changed)
kubevigil fix ./manifests/
# Apply safe fixes with comment-preserving YAML edits
kubevigil fix ./manifests/ --apply
# Fix + re-scan to verify (fails if issues remain)
kubevigil fix ./manifests/ --apply --verifyAI assistant integration — MCP server config
// claude_desktop_config.json
{
"mcpServers": {
"kubevigil": {
"command": "kubevigil",
"args": ["mcp-server"]
}
}
}Once configured, Claude, Cursor, or VS Code Copilot can scan your clusters, query findings, and get remediation guidance through natural conversation — no extra tooling required.
Installation
# Homebrew (macOS / Linux)
brew install stribog-cloud/tap/kubevigil
# kubectl plugin via Krew
kubectl krew install vigil
# Go install from source
go install github.com/stribog-cloud/kubevigil/cmd/kubevigil@latestSingle Apache 2.0 binary. No per-seat licensing, no vendor lock-in on your security tooling.
Maps every finding to CIS, MITRE ATT&CK, and NSA/CISA. SARIF output integrates directly into GitHub Security and IDE workflows.
Run it in your own CI pipeline, on your own hardware, against your own clusters. No telemetry, no SaaS dependency.
Eight output formats and CI-native exit codes mean KubeVigil integrates with your pipeline today and stays integrable tomorrow.
§00/The Five Pillars
Sovereignty
OWN-THE-PERIMETER
Engineering teams owning the full stack they depend on — no invisible landlords, no rented foundations.
Open source as method
OSS-AS-DISCIPLINE
Open source is a discipline of review, contribution, and independence — not a license type to tick on an audit form.
Audit-grade rigor
EVIDENCE-BY-DEFAULT
Security and compliance aren't retrofit — they are the bar that makes self-hosting safe in regulated, serious environments.
Optionality
EXIT-RAMPS-DESIGNED-IN
Anti-lock-in by architecture: every layer has a documented exit ramp so no vendor can hold you hostage.
The long game
BUILT-FOR-DECADES
Systems proportioned to outlast the tools, vendors, and leadership changes that will come in the decade after delivery.
WORKING TOGETHER ON OSS
Build it, use it, improve it
Every tool in the stack we deploy is open to inspection, contribution, and fork. That is not altruism — it is the engineering model that keeps expertise current and keeps clients free.
Use it
Run KubeVigil in your own CI pipeline against your own clusters. File issues when you find edge cases. The README is the contract.
Contribute
New checks, output formats, fix strategies, and integration tests are all in scope. See the Contributing Guide in the KubeVigil repo. We review PRs with the same rigor we bring to production systems.
Engage the practice
If you need KubeVigil integrated into a regulated environment — with evidence packaging, SBOM generation, and audit trail — that is a consulting engagement. Book an executive briefing to start.
Executive Briefing
Thirty minutes to clarify your infrastructure risk
Walk us through your vendor footprint and regulatory constraints. We will tell you honestly where sovereignty creates leverage — and where it does not. No pitch deck. No obligation.