Systems, rendered as systems

Defence in depth on a GKE estate: every layer assumes the one in front of it has already been breached. Nothing here trusts the network.

13 components · 12 flows

Stages fan out in parallel per pull request instead of running serially per repo. Advisory mode reports without blocking until a team opts in.

9 components · 11 flows

istiod issues short-lived certificates; PeerAuthentication enforces STRICT on the server, DestinationRule sends mTLS from the client. A sidecar-less caller is refused — that's the feature.

6 components · 4 flows

A recurring incident with a known fix gets wired to the signal instead of to a human. Roughly 80% resolve before anyone is paged.

6 components · 6 flows

Developers click a template; the portal produces a pull request. Nothing reaches an environment without peer review and an audit trail.

8 components · 7 flows

Every hop a request makes between the public internet and a container, and the four independent layers that can each make a healthy pod look down.

10 components · 9 flows

A release moving through weighted canary steps, with the analysis that promotes it and the two ways it gets stuck instead.

9 components · 9 flows

Ephemeral CI agents, where their dependencies come from, and why a fleet that worked for a year starts failing on a busy Tuesday.

9 components · 9 flows

How a secret gets from a managed vault into a running container without ever being committed, and why a missing one fails completely silently.

9 components · 8 flows