DevOps, SRE, Platform Engineering, and AI-driven delivery — by Haggai Philip Zagury.https://portfolio.hagzag.com/enhttps://portfolio.hagzag.com/blog/2026-06-06-brake-pedal-or-press-release/https://portfolio.hagzag.com/blog/2026-06-06-brake-pedal-or-press-release/Anthropic wants the option to pause frontier AI development. A platform engineer reads the data behind the 'recursive self-improvement' warning — and the timing.Sat, 06 Jun 2026 16:36:28 GMTagentic-aiai-safetyrecursive-self-improvementplatform-engineeringdevopsanthropicai-governancehttps://portfolio.hagzag.com/blog/2026-05-30-the-knowledge-bill-comes-due/https://portfolio.hagzag.com/blog/2026-05-30-the-knowledge-bill-comes-due/A follow-up to The AI Headcount Panic. The numbers crossed 150,000, and the first codebases gutted of senior engineers are starting to break. The bill arrives on a lag.Sat, 30 May 2026 23:34:00 GMTailayoffsplatform-engineeringinstitutional-knowledgeengineering-managementtechnical-debthttps://portfolio.hagzag.com/blog/2026-05-27-the-ai-headcount-panic/https://portfolio.hagzag.com/blog/2026-05-27-the-ai-headcount-panic/Companies across the globe—and Israeli high-tech especially—are mass-laying off in the name of AI. But is AI really the reason, or just the best available excuse?Wed, 27 May 2026 08:00:00 GMTailayoffsplatform-engineeringdeveloper-productivityisraeli-techorganizational-changeagentic-aiknowledge-managementhttps://portfolio.hagzag.com/blog/reading-lists/cilium-in-practice/2026-05-15-cilium-series-introduction/https://portfolio.hagzag.com/blog/reading-lists/cilium-in-practice/2026-05-15-cilium-series-introduction/Three forces pushed Cilium onto my roadmap: a VPC-CNI silent-drop bug, a FedRAMP project, and a pattern in every recent breach I've reviewed. Here's the series.Fri, 15 May 2026 10:00:00 GMTciliumebpfkubernetesnetwork-policyeksfedrampfipshttps://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-14-fedramp-platform-side-glossary-copy/https://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-14-fedramp-platform-side-glossary-copy/A quick-reference glossary of NIST SP 800-53 control families referenced throughout the FedRAMP series — RA, CM, SA, AC, AU, SI — and what each one means for platform engineers.Thu, 14 May 2026 09:00:00 GMTfedrampnist-sp-800-53complianceplatform-engineeringrisk-assessmentconfiguration-managementsystem-acquisitionaccess-controlaudithttps://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-12-fedramp-platform-side-part-4/https://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-12-fedramp-platform-side-part-4/Drawing the FedRAMP authorization boundary is the most consequential platform decision in the program — what's in, what's leveraged, what's external, and how 20x turns the boundary from a Visio diagram into a data structure.Tue, 12 May 2026 11:00:00 GMTfedrampfedramp-20xauthorization-boundarycomplianceplatform-engineeringdevopsshared-responsibilitygovcloudhttps://portfolio.hagzag.com/blog/2026-05-12-the-infrastructure-wall-agents-in-production/https://portfolio.hagzag.com/blog/2026-05-12-the-infrastructure-wall-agents-in-production/Everyone prototypes an AI agent in a weekend. Almost nobody ships it cleanly. Here's the wall you're about to hit — and how the platform is evolving to remove it.Tue, 12 May 2026 06:00:00 GMTagentic-aiplatform-engineeringdevopscloud-nativellm-opscloud-managed-agentsproduction-readinesshttps://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-12-fedramp-platform-side-part-3/https://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-12-fedramp-platform-side-part-3/FIPS-validated crypto is a hard requirement inside a FedRAMP boundary — not a best practice. A practitioner's walkthrough of where FIPS lands across 800-53 control families, and how the Building for Compliance supply-chain work maps onto it.Tue, 12 May 2026 06:00:00 GMTfedrampfipsfips-140-3complianceplatform-engineeringcryptographysupply-chain-securitycontainershttps://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-02-fedramp-platform-side-part-2/https://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-05-02-fedramp-platform-side-part-2/A platform engineer's plain-English walkthrough of what FedRAMP actually is — impact levels, the document set (SSP, SAR, POA&M), the ATO process, and how Rev5 and 20x change the picture in 2026.Sat, 02 May 2026 06:00:00 GMTfedrampfedramp-20xcomplianceplatform-engineeringdevopsnist-800-53atooscalhttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2026-04-30-soc2-series-2026-refresh/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2026-04-30-soc2-series-2026-refresh/A short note on why I refreshed the 5-part SOC 2 for ISVs series in 2026 — modernized imagery, and a reset of my own field knowledge from +-5-7 years of customer engagements.Wed, 29 Apr 2026 04:00:00 GMTsoc2complianceisvseries-updateretrospectivehttps://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-04-28-fedramp-platform-side-part-1/https://portfolio.hagzag.com/blog/reading-lists/fedramp-journey/2026-04-28-fedramp-platform-side-part-1/A platform engineer's take on starting the FedRAMP journey from outside the US — why a third-party partner matters, and what the '90 days' promise really means in 2026.Tue, 28 Apr 2026 06:00:00 GMTfedrampcomplianceplatform-engineeringdevopssoc2fips3paofedramp-20xhttps://portfolio.hagzag.com/blog/2026-04-27-ci-secrets-oidc-external-secrets-manager/https://portfolio.hagzag.com/blog/2026-04-27-ci-secrets-oidc-external-secrets-manager/Why masked CI variables and GitHub encrypted secrets are not enough — and how to replace them with OIDC-based access to HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager.Mon, 27 Apr 2026 08:00:00 GMTsecrets-managementoidcgithub-actionsgitlab-cihashicorp-vaultaws-secrets-managergcp-secret-managerci-cdsecurityzero-trusthttps://portfolio.hagzag.com/blog/2026-04-24-blogging-with-astro/https://portfolio.hagzag.com/blog/2026-04-24-blogging-with-astro/How I set up my personal blog and portfolio using Astro and GitHub Pages — zero cost, full control, and a git push away from publishing.Fri, 24 Apr 2026 05:00:00 GMTastrogithub-pagesstatic-siteblogportfoliogithub-actionstailwindcssmarkdowndeveloper-experiencehttps://portfolio.hagzag.com/blog/2026-04-23-cloudflare-warp-ci-private-endpoints-terragrunt/https://portfolio.hagzag.com/blog/2026-04-23-cloudflare-warp-ci-private-endpoints-terragrunt/How to connect GitHub Actions runners to private infrastructure using Cloudflare Zero Trust WARP and a service account — enabling Terragrunt to reach private endpoints without IP allowlisting.Thu, 23 Apr 2026 08:00:00 GMTcloudflarezero-trustgithub-actionsgitlab-citerragruntterraformnetworkingci-cdwarpsecurityhttps://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-4-from-signed-image-to-verified-pipeline/https://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-4-from-signed-image-to-verified-pipeline/Wiring a signed Wolfi toolchain image into a real consumer pipeline, verifying it at deploy time with Sigstore policy-controller, and digest-pinning with Renovate — the series finale.Tue, 21 Apr 2026 10:00:00 GMTsupply-chain-securitycosignsigstorekubernetesadmission-controlgithub-actionsrenovatewolfiterraformsemantic-releasehttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/the-reverse-tunnel/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/the-reverse-tunnel/ngrok, cloudflared, Tailscale Funnel, frp — a practitioner's map of reverse tunnels: how they work, when they're production-grade, and how they fit the Zero Trust picture.Tue, 21 Apr 2026 10:00:00 GMTngrokcloudflare-tunnelcloudflaredtailscalefrpreverse-tunnelzero-trustremote-accessdnshttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/compliance-cloud-and-consulting-from-anywhere/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/compliance-cloud-and-consulting-from-anywhere/The finale of the Zero Trust series: where compliance frameworks meet ZTNA, how the hyperscalers ship it natively, and what twenty years of remote-access evolution means for working practitioners.Mon, 20 Apr 2026 18:00:00 GMTzero-trustcompliancesoc2fipsaws-verified-accessbeyondcorpentra-idconsultingremote-accessdnshttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/zero-trust-networking-identity-meets-the-network/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/zero-trust-networking-identity-meets-the-network/ZTNA is what you get when you stop treating the network as the trust boundary and make every packet a policy decision against identity. A practitioner's map of the model, the vendors, and the DNS turn.Mon, 20 Apr 2026 16:00:00 GMTzero-trustztnacloudflaretailscalebeyondcorpremote-accessdnskubernetesk3dhttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/identity-is-the-new-perimeter/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/identity-is-the-new-perimeter/OAuth is authorization. OIDC is identity. MFA is necessary but not sufficient. A practitioner's map of AuthN, AuthZ, federation, and the DevOps use cases that live on top.Mon, 20 Apr 2026 14:00:00 GMTidentityoauthoidcsamlmfapasskeyszero-trustkeycloakkuberneteshttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/wireguard-why-simpler-won/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/wireguard-why-simpler-won/WireGuard won because it's boring — a short config, a fixed crypto suite, and a kernel module the size of a caffeine habit. Here's the practitioner's case for it in 2026.Mon, 20 Apr 2026 12:00:00 GMTwireguardvpnremote-accesszero-trusttailscalednskubernetesk3dhttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/vpns-openvpn-ipsec-and-the-tls-tunnel/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/vpns-openvpn-ipsec-and-the-tls-tunnel/VPNs extended the trust boundary over the public internet — and preserved the flaw at the heart of it. A practitioner's tour of OpenVPN, IPsec, split-DNS, and the DPI blocking era.Mon, 20 Apr 2026 11:00:00 GMTvpnopenvpnipsecremote-accesszero-trustdnskubernetesk3dhttps://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-3-building-secure-containers-on-wolfi/https://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-3-building-secure-containers-on-wolfi/Part 3 — how I put Wolfi, syft, grype, and cosign to work in hagzag/tools: a CI toolchain image with SBOM validation, keyless signing, and a single-command local loop.Mon, 20 Apr 2026 10:00:00 GMTwolfichainguardcontainerssbomsyftgrypecosignsupply-chain-securityterraformterragruntgithub-actionshttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/ssh-and-the-cryptographic-turn/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/ssh-and-the-cryptographic-turn/SSH replaced telnet in a few years and still runs everything three decades later. Here's why 'SSH is solved' is the most dangerous sentence in your runbook.Mon, 20 Apr 2026 10:00:00 GMTsshremote-accesszero-trustcertificatesbastionopensshkubernetesk3dhttps://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/from-trusted-wires-to-the-open-internet/https://portfolio.hagzag.com/blog/reading-lists/path2zerotrust/from-trusted-wires-to-the-open-internet/Why telnet, rsh, and finger made sense once — and why every modern remote-access control traces back to the moment the wire stopped being trusted.Mon, 20 Apr 2026 09:00:00 GMTremote-accessnetworkingzero-trusthistoryosi-modeldnskubernetesk3dhttps://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-2-building-on-wolfi-os/https://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-2-building-on-wolfi-os/Wolfi OS, apko, melange, and Chainguard's daily rebuild model — a practitioner's evaluation of the open-source path to low-CVE, FIPS/FedRAMP-ready images.Sun, 19 Apr 2026 10:00:00 GMTwolfichainguardcontainersapkomelangesupply-chain-securitycvefipsfedrampkuberneteshttps://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-1-a-supply-chain-security-primer/https://portfolio.hagzag.com/blog/reading-lists/building-complient-software/rebuilding-for-compliance-part-1-a-supply-chain-security-primer/SBOM, provenance, SLSA, cosign — and how FIPS 140-2/3 and FedRAMP land on your container images. A practitioner's map before the rebuild begins.Sat, 18 Apr 2026 10:00:00 GMTsupply-chain-securitysbomslsacosignsigstorefipsfedrampcontainerscompliancehttps://portfolio.hagzag.com/blog/medium/from-api-to-owned-minimax-m2-7-gemma-4-and-the-case-for-running-models-on-your-laptop/https://portfolio.hagzag.com/blog/medium/from-api-to-owned-minimax-m2-7-gemma-4-and-the-case-for-running-models-on-your-laptop/Two major open-source model releases in one week signal a tipping point. Here's why I'm running capable agent models on my own hardware — and how you can too.Tue, 14 Apr 2026 05:00:00 GMTollamak3dkubernetesgemmaminimaxopen-source-llmlocal-aiplatform-engineeringagent-cost-warshttps://portfolio.hagzag.com/blog/medium/autonomous-agent-p1-clawjacked-axios-and-the-autonomous-agent-problem/https://portfolio.hagzag.com/blog/medium/autonomous-agent-p1-clawjacked-axios-and-the-autonomous-agent-problem/A practitioner's field notes on March 2026: OpenClaw's CVE flood, the Axios npm RAT, and why self-hosted autonomous agents are standing in the blast zone.Fri, 10 Apr 2026 10:00:00 GMTautonomous-agentssecuritysupply-chainopenclawprompt-injectionagentic-aidevsecopshttps://portfolio.hagzag.com/blog/medium/autonomous-agent-p2-i-want-a-personal-agent-im-not-running-one-yet-here-s-what-would-change-that/https://portfolio.hagzag.com/blog/medium/autonomous-agent-p2-i-want-a-personal-agent-im-not-running-one-yet-here-s-what-would-change-that/Part 2: sandboxing with agent-sandbox, evaluating nanobot and nanoclaw, prompt injection realities, and the pre-flight checklist before I trust an autonomous agent.Thu, 09 Apr 2026 11:00:00 GMTautonomous-agentssecuritysandboxingagent-sandboxnanobotprompt-injectionagentic-aidevsecopshttps://portfolio.hagzag.com/blog/medium/andrej-karpathy-just-made-rag-obsolete-and-all-you-need-is-three-folders/https://portfolio.hagzag.com/blog/medium/andrej-karpathy-just-made-rag-obsolete-and-all-you-need-is-three-folders/Andrej Karpathy dropped a paradigm-shifting gist on building personal knowledge bases with LLMs — no vector DB, no embeddings, just raw/wiki/output folders. Here's what it means for the rest of us.Tue, 07 Apr 2026 08:00:00 GMTkarpathyragllmknowledge-managementobsidianplatform-engineeringagentic-aivibe-codingautoresearchhttps://portfolio.hagzag.com/blog/medium/cost-of-intelligence-02/https://portfolio.hagzag.com/blog/medium/cost-of-intelligence-02/A follow-up to my MiniMax M2.5 piece — challenging my own assumptions with fresh Artificial Analysis data, GLM-5, M2.7, and what this means for coders in 2026.Tue, 31 Mar 2026 08:00:00 GMTllm-pricingminimaxglm-5claude-opusartificial-analysisagentic-aicost-optimizationcoding-agentsdevopshttps://portfolio.hagzag.com/blog/medium/why-growing-organizations-need-the-outsiders-mirror/https://portfolio.hagzag.com/blog/medium/why-growing-organizations-need-the-outsiders-mirror/How a consultant's external perspective helps scaling organizations shift from reactive execution to intentional alignment — and why staying silent is the real failure.Tue, 31 Mar 2026 06:00:00 GMTconsultingthought-leadershipplatform-engineeringorganizational-patternsagentic-sdlcengineering-cultureteam-topologyhttps://portfolio.hagzag.com/blog/medium/cost-of-intelligence-01/https://portfolio.hagzag.com/blog/medium/cost-of-intelligence-01/MiniMax M2.5 achieves near-Opus 4.6 performance at 3% the cost. What this means for always-on agents, the SWE-bench, and the falling cost of intelligence.Sun, 22 Mar 2026 06:00:00 GMTminimax-m2.5always-on-agentsswe-benchllm-costagentic-aiopencodeplatform-engineeringmixture-of-expertshttps://portfolio.hagzag.com/blog/medium/aws-kms-key-strategy/https://portfolio.hagzag.com/blog/medium/aws-kms-key-strategy/AWS KMS gives you three flavors of encryption keys. For anything resembling production, CMKs are the only real choice. This post covers key granularity, aliases, ransomware shields, and cross-account access patterns.Fri, 20 Mar 2026 05:00:00 GMTawskmsencryptionsecurityinfrastructure-as-codeterraformhttps://portfolio.hagzag.com/blog/medium/aws-landing-zone-accelerator-multi-account-governance/https://portfolio.hagzag.com/blog/medium/aws-landing-zone-accelerator-multi-account-governance/How AWS Landing Zone Accelerator (LZA) turns YAML configs into governed multi-account environments with Transit Gateway isolation, NACLs, and HIPAA-ready networking.Thu, 19 Mar 2026 08:00:00 GMTawslanding-zone-acceleratorcontrol-towertransit-gatewaymulti-accounthipaainfrastructure-as-codecdknetwork-architecturecompliancehttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2026-03-10-declarative-iac-series-recap/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2026-03-10-declarative-iac-series-recap/A recap of the 5-part series on production Terraform & Terragrunt patterns — module versioning, multi-account OIDC, CI/CD pipelines — updated March 2026 with tooling comparisons and field notes.Tue, 10 Mar 2026 08:00:00 GMTterraformterragruntiacawsoidcgithub-actionsgitlab-cimulti-accountci-cdseries-recaphttps://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-03-04-dns-series-glossary/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-03-04-dns-series-glossary/A practical glossary for the DNS Evolution in Practice series: core DNS records, service discovery terms, traffic management concepts, and DNS security vocabulary.Wed, 04 Mar 2026 05:00:00 GMTdnsnetworkingservice-discoverysecurityplatform-engineeringhttps://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-03-03-dns-series-introduction/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-03-03-dns-series-introduction/Why I'm writing a four-part DNS series in 2026. Notes from 25 years of teaching the topic that most engineers — and most curricula — quietly underestimate.Tue, 03 Mar 2026 04:21:32 GMTdnsplatform-engineeringteachinginfrastructureservice-discoveryhigh-availabilityhttps://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-15-dns-part-4-when-dns-lies/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-15-dns-part-4-when-dns-lies/How DNS attacks actually work — Kaminsky, Sea Turtle, MyEtherWallet, DigiNotar — and the layered defenses that hold up: DNSSEC, DoH, CAA, registrar lock.Sun, 15 Feb 2026 18:53:55 GMTdnsdnssecsecurityinfrastructureplatform-engineeringincident-responsehttps://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-11-dns-part-3-dns-as-a-load-balancer/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-11-dns-part-3-dns-as-a-load-balancer/How DNS sits in front of cloud load balancers, what each LB tier actually sees, and the brutal truth about TTLs in multi-region high availability.Wed, 11 Feb 2026 18:53:55 GMTdnsload-balancinghigh-availabilityawsgcpazureroute53https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-07-dns-part-2-service-discovery-consul-coredns/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-07-dns-part-2-service-discovery-consul-coredns/How ephemeral cloud-native workloads broke traditional DNS, and how Consul and CoreDNS rebuilt it as a real-time service catalog.Sat, 07 Feb 2026 18:53:55 GMTdnskubernetesconsulcorednsservice-discoverycloud-nativehttps://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-03-dns-part-1-from-hosts-file-to-bind-9/https://portfolio.hagzag.com/blog/reading-lists/dns-evolution-in-practice/2026-02-03-dns-part-1-from-hosts-file-to-bind-9/A practitioner's tour of DNS — from the hosts file era and BIND at Berkeley to CoreDNS in Kubernetes — and the record types every engineer should actually understand.Tue, 03 Feb 2026 18:53:55 GMTdnsbindnetworkinginfrastructureplatform-engineeringservice-discoveryhttps://portfolio.hagzag.com/blog/reading-lists/cilium-in-practice/2025-11-08-cilium-part-1-k3d-lab/https://portfolio.hagzag.com/blog/reading-lists/cilium-in-practice/2025-11-08-cilium-part-1-k3d-lab/A practitioner's k3d lab for Cilium: install it next to your laptop, walk a CiliumNetworkPolicy progression from default-deny to L7 HTTP filtering, and read the drops in Hubble.Sat, 08 Nov 2025 10:00:00 GMTciliumebpfkubernetesk3dnetwork-policyhubbleplatform-engineeringhttps://portfolio.hagzag.com/blog/medium/ai-chaos-and-productivity-how-to-choose-your-core-tool-start-and-stop-the-fomo/https://portfolio.hagzag.com/blog/medium/ai-chaos-and-productivity-how-to-choose-your-core-tool-start-and-stop-the-fomo/Wed, 20 Aug 2025 05:00:00 GMTpre-commitpythongitdevexDevelopmentToolshttps://portfolio.hagzag.com/blog/medium/taiming-the-ai-beast-wtih-llm-gw/https://portfolio.hagzag.com/blog/medium/taiming-the-ai-beast-wtih-llm-gw/Wed, 20 Aug 2025 05:00:00 GMTpre-commitpythongitdevexDevelopmentToolshttps://portfolio.hagzag.com/blog/medium/the-cost-of-coversation/https://portfolio.hagzag.com/blog/medium/the-cost-of-coversation/Wed, 20 Aug 2025 05:00:00 GMTaillmllm-pricingcost-optimizationagent-cost-warshttps://portfolio.hagzag.com/blog/medium/vibiing-or-building/https://portfolio.hagzag.com/blog/medium/vibiing-or-building/Wed, 20 Aug 2025 05:00:00 GMTaiLLMdevexDevelopmentToolsProductivityhttps://portfolio.hagzag.com/blog/med-from-bad-habbits-to-clarity/https://portfolio.hagzag.com/blog/med-from-bad-habbits-to-clarity/Sun, 27 Jul 2025 07:00:00 GMTProductivityEngineeringHabbitsA.I Driven DevOpsdevopsagentic-aihttps://portfolio.hagzag.com/blog/youtube/pel-q2ydcwo/https://portfolio.hagzag.com/blog/youtube/pel-q2ydcwo/Sat, 24 May 2025 09:21:00 GMTWebinar12-15 factorsYoutubedevexhttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-05-24-declarative-iac-part5-gitlab-ci/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-05-24-declarative-iac-part5-gitlab-ci/GitLab CI for Terragrunt: web_identity_token keyless AWS auth, YAML anchor job templates, static-per-environment pipeline structure, and the one rule that's never negotiable — destroy is always manual.Sat, 24 May 2025 08:00:00 GMTgitlab-citerragruntterraformci-cdoidcawsshared-templatesweb-identity-tokenhttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-12-soc2-surviving-the-audit/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-12-soc2-surviving-the-audit/Choosing an auditor, surviving the Type II observation window, common findings, and how SOC 2 becomes the foundation for ISO 27001, HIPAA, and FedRAMP.Mon, 12 May 2025 20:45:00 GMTsoc2complianceauditiso-27001hipaafedrampisvdevopshttps://portfolio.hagzag.com/blog/medium/ai-driven-devops-1/https://portfolio.hagzag.com/blog/medium/ai-driven-devops-1/Mon, 05 May 2025 05:00:00 GMTaiA.I Driven DevOpsdevopsagentic-aihttps://portfolio.hagzag.com/blog/medium/ai-driven-devops-2/https://portfolio.hagzag.com/blog/medium/ai-driven-devops-2/Mon, 05 May 2025 05:00:00 GMTaiA.I Driven DevOpsdevopsagentic-aihttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-03-soc2-continuous-compliance/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-03-soc2-continuous-compliance/How to turn SOC 2 from a yearly fire drill into a byproduct of how you build — AWS SCPs, GCP Org Policies, OPA, drift detection, and automated evidence collection.Sat, 03 May 2025 20:15:00 GMTsoc2compliancepolicy-as-codescpaws-organizationsoparegogitopsdevopsplatform-engineeringhttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-05-03-declarative-iac-part4-github-actions/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-05-03-declarative-iac-part4-github-actions/Building a smart GitHub Actions pipeline for Terragrunt: hierarchical HCL change detection, dynamic matrix plans posted as PR comments, and apply-on-merge — no Atlantis, no Terraform Cloud.Sat, 03 May 2025 08:00:00 GMTgithub-actionsterragruntterraformci-cdoidcawschange-detectionmatrixhttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-02-soc2-technical-foundation/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-05-02-soc2-technical-foundation/How to map SOC 2 controls to your AWS, GCP, and Kubernetes stack — IAM, logging, encryption, change management, and what auditors actually want to see.Fri, 02 May 2025 19:45:00 GMTsoc2complianceawsgcpkubernetesiamdevopsplatform-engineeringhttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-04-05-declarative-iac-part3-tf-live/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-04-05-declarative-iac-part3-tf-live/The account/region/env directory hierarchy that replaces Terraform workspaces, Terragrunt's built-in navigation functions, OIDC hub-and-spoke multi-account auth, and the one-time bootstrap that sets it all up.Sat, 05 Apr 2025 08:00:00 GMTterraformterragruntawsoidcmulti-accountiamblast-radiushclhttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-03-29-soc2-trust-service-criteria-demystified/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-03-29-soc2-trust-service-criteria-demystified/What the five SOC 2 Trust Service Criteria actually mean, which are mandatory, and how to scope your audit so it doesn't sprawl. Part 2 of 5.Sat, 29 Mar 2025 19:15:00 GMTsoc2compliancetrust-service-criteriaisvaudit-scopingawsgcphttps://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-03-28-soc2-for-isvs-price-of-admission/https://portfolio.hagzag.com/blog/reading-lists/soc2-complience/2025-03-28-soc2-for-isvs-price-of-admission/Why SOC 2 has become non-negotiable for ISVs selling to enterprises — and what it actually costs to skip it. Part 1 of a 5-part series.Fri, 28 Mar 2025 18:45:00 GMTsoc2complianceisventerprise-salesawsgcpdevopshttps://portfolio.hagzag.com/blog/youtube/w2sxocnydbq/https://portfolio.hagzag.com/blog/youtube/w2sxocnydbq/Tue, 25 Mar 2025 09:21:00 GMTWebinar12-15 factorsYoutubedevexDagsterAibytehttps://portfolio.hagzag.com/blog/youtube/7frxsgeops4/https://portfolio.hagzag.com/blog/youtube/7frxsgeops4/Mon, 24 Mar 2025 09:21:00 GMTWebinar12-15 factorsYoutubedevexhttps://portfolio.hagzag.com/blog/presentations/app-driven-iac-with-crossplane/https://portfolio.hagzag.com/blog/presentations/app-driven-iac-with-crossplane/Wed, 19 Mar 2025 09:00:00 GMTcrossplaneapp-driven-iacmeetuphttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-03-08-declarative-iac-part2-tf-modules/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-03-08-declarative-iac-part2-tf-modules/How to treat Terraform modules as versioned libraries: semantic-release git tags, Dependabot drift detection, terraform-docs auto-generation, and tfsec/Trivy in CI — on both GitHub and GitLab.Sat, 08 Mar 2025 08:00:00 GMTterraformsemantic-releaseci-cdtfsectrivygithub-actionsgitlab-cimodulesdependabothttps://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-02-15-declarative-iac-part1-why-terragrunt/https://portfolio.hagzag.com/blog/reading-lists/declerative-iac/2025-02-15-declarative-iac-part1-why-terragrunt/How Terragrunt solves the DRY problem Terraform leaves behind: per-module state, a dependency graph, and run-all fan-out — without forking your modules or touching workspaces.Sat, 15 Feb 2025 08:00:00 GMTterraformterragruntiacawsdeclarativemulti-accountdryhttps://portfolio.hagzag.com/blog/medium/s3-csi-driver-eks/https://portfolio.hagzag.com/blog/medium/s3-csi-driver-eks/Sat, 25 Jan 2025 05:00:00 GMTkubernetesS3EKSS3 CSI DriverObject Storagehttps://portfolio.hagzag.com/blog/youtube/5ngevnfgwnw/https://portfolio.hagzag.com/blog/youtube/5ngevnfgwnw/Wed, 31 Jul 2024 07:23:00 GMTWebinarProduction Readinesshttps://portfolio.hagzag.com/blog/medium/scaling-with-keda/https://portfolio.hagzag.com/blog/medium/scaling-with-keda/A hands-on lab using K3d and KEDA to demonstrate horizontal scaling patterns for event-driven workloads.Sun, 14 Jul 2024 06:50:56 GMTkubernetesKEDAEvent Driven Architecturehttps://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-07-08-5-prod-readyness-scheduling/https://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-07-08-5-prod-readyness-scheduling/Why scheduling, resource requests, and controller loops matter when designing a production-ready Kubernetes platform.Mon, 08 Jul 2024 05:00:00 GMTProduction Readinesssrekuberneteshttps://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-23-4-prod-readyness-ingress/https://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-23-4-prod-readyness-ingress/Thu, 23 May 2024 05:00:00 GMTProduction Readinesssrekuberneteshttps://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-17-3-prod-readyness-dns-service-discovery/https://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-17-3-prod-readyness-dns-service-discovery/Fri, 17 May 2024 05:00:00 GMTProduction Readinesssrekuberneteshttps://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-10-2-prod-readyness-secrets/https://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-10-2-prod-readyness-secrets/Fri, 10 May 2024 05:00:00 GMTProduction Readinesssrekuberneteshttps://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-05-1-prod-readyness-planning/https://portfolio.hagzag.com/blog/reading-lists/production-ready-kubernetes/2024-05-05-1-prod-readyness-planning/Sun, 05 May 2024 05:00:00 GMTProduction Readinesssrekuberneteshttps://portfolio.hagzag.com/blog/medium/self-service-devenv/https://portfolio.hagzag.com/blog/medium/self-service-devenv/Why self-service development environments matter for modern teams and how automation, standardization, and templates reduce onboarding friction.Wed, 24 Apr 2024 18:54:59 GMTdevexdevopshttps://portfolio.hagzag.com/blog/medium/whyblog-2024/https://portfolio.hagzag.com/blog/medium/whyblog-2024/Personal reflections on writing, collaboration, and the value of storytelling in the 2024 tech community.Tue, 27 Feb 2024 00:00:00 GMTProductivityWritingCommunityhttps://portfolio.hagzag.com/blog/medium/secure-at-dev-k8s-and-bitwarden-sm-operator/https://portfolio.hagzag.com/blog/medium/secure-at-dev-k8s-and-bitwarden-sm-operator/This post will show you how to secure your local development environment by using Bitwarden Secrets Manager with K3d.Wed, 17 Jan 2024 00:01:00 GMTSecretskubernetesBitwardenk3dhttps://portfolio.hagzag.com/blog/medium/declerative-vs-imperative-or-programatic/https://portfolio.hagzag.com/blog/medium/declerative-vs-imperative-or-programatic/Explore the nuances of declarative and imperative Infrastructure as Code (IaC) approaches. Learn how to choose the right method for your team and project needs, with insights from real-world experiences using tools like Terraform, AWS CDK, and Pulumi.Mon, 15 Jan 2024 05:00:00 GMTIaCTerraformGitOpsCDKPulumiDeclarativeImperativehttps://portfolio.hagzag.com/blog/dot-files/https://portfolio.hagzag.com/blog/dot-files/Tue, 02 Jan 2024 05:00:00 GMTdotfilesconfigdevexhttps://portfolio.hagzag.com/blog/pre-commit/https://portfolio.hagzag.com/blog/pre-commit/Tue, 02 Jan 2024 05:00:00 GMTpre-commitpythongitdevexDevelopmentToolshttps://portfolio.hagzag.com/blog/task-files/https://portfolio.hagzag.com/blog/task-files/Explore how go-task can transform your development workflow by providing a modern, cloud-native task runner alternative to traditional Makefiles.Tue, 02 Jan 2024 05:00:00 GMTdotfilesconfigdevexToolshttps://portfolio.hagzag.com/blog/medium/alm-2-platform/https://portfolio.hagzag.com/blog/medium/alm-2-platform/Tue, 02 Jan 2024 05:00:00 GMTdotfilesconfigdevexhttps://portfolio.hagzag.com/blog/medium/controloop/https://portfolio.hagzag.com/blog/medium/controloop/Tue, 02 Jan 2024 05:00:00 GMTdotfilesconfigdevexhttps://portfolio.hagzag.com/blog/medium/iac-gitops-with-eks-blueprints/https://portfolio.hagzag.com/blog/medium/iac-gitops-with-eks-blueprints/Tue, 02 Jan 2024 05:00:00 GMTIaCTerraformGitOpsEKShttps://portfolio.hagzag.com/blog/medium/kubexpereince-intro/https://portfolio.hagzag.com/blog/medium/kubexpereince-intro/A walkthrough of the Kubexperience workshop for developers, covering Kubernetes fundamentals, demos, and resources.Tue, 02 Jan 2024 05:00:00 GMTkubernetesk3dhttps://portfolio.hagzag.com/blog/medium/taskfile-yak-shaving/https://portfolio.hagzag.com/blog/medium/taskfile-yak-shaving/Discover how go-task can transform your development workflow by eliminating yak shaving and streamlining task management.Tue, 02 Jan 2024 05:00:00 GMTdotfilesconfigdevexhttps://portfolio.hagzag.com/blog/12-factor/https://portfolio.hagzag.com/blog/12-factor/Tue, 14 Mar 2023 05:00:00 GMT15-factor12-factorcloud-nativemicroserviceshttps://portfolio.hagzag.com/blog/youtube/3azxwt1am64/https://portfolio.hagzag.com/blog/youtube/3azxwt1am64/Wed, 11 Jan 2023 07:23:00 GMTChaos Engineeringdevexhttps://portfolio.hagzag.com/blog/youtube/hdjfyi8egvi/https://portfolio.hagzag.com/blog/youtube/hdjfyi8egvi/Wed, 11 Jan 2023 07:23:00 GMTHelmkuberneteshttps://portfolio.hagzag.com/blog/youtube/xybc7mttge4/https://portfolio.hagzag.com/blog/youtube/xybc7mttge4/Wed, 11 Jan 2023 07:23:00 GMTMonitoringhttps://portfolio.hagzag.com/blog/youtube/9ox5o0a0noi/https://portfolio.hagzag.com/blog/youtube/9ox5o0a0noi/Sun, 04 Dec 2022 09:21:00 GMTProduction ReadinessYoutubeTechRadarConsecurityhttps://portfolio.hagzag.com/blog/youtube/jybsn6ij1qc/https://portfolio.hagzag.com/blog/youtube/jybsn6ij1qc/Sun, 04 Dec 2022 09:21:00 GMTWebinarYoutubedevexhttps://portfolio.hagzag.com/blog/youtube/s001/https://portfolio.hagzag.com/blog/youtube/s001/Sun, 04 Dec 2022 09:21:00 GMTYoutubeShortshttps://portfolio.hagzag.com/blog/youtube/vzmda8qs3jw/https://portfolio.hagzag.com/blog/youtube/vzmda8qs3jw/Tue, 22 Nov 2022 09:21:00 GMTTechRadarConProduction ReadinessYoutubedevexhttps://portfolio.hagzag.com/blog/ielf-forum-1/https://portfolio.hagzag.com/blog/ielf-forum-1/Fri, 04 Nov 2022 09:00:00 GMTsoftwaremicroservicesdora-metricstech-talkhttps://portfolio.hagzag.com/blog/presentations/0001/https://portfolio.hagzag.com/blog/presentations/0001/Fri, 04 Nov 2022 09:00:00 GMTsoftwaremicroservicesdora-metricstech-talkhttps://portfolio.hagzag.com/blog/youtube/2yvd6locxps/https://portfolio.hagzag.com/blog/youtube/2yvd6locxps/Tue, 26 Jul 2022 07:23:00 GMTChaos Engineeringdevexhttps://portfolio.hagzag.com/blog/devpod/https://portfolio.hagzag.com/blog/devpod/Mon, 04 Apr 2022 05:00:00 GMTsoftwaremicroservicesdora-metricshttps://portfolio.hagzag.com/blog/dora-metrics/https://portfolio.hagzag.com/blog/dora-metrics/Mon, 04 Apr 2022 05:00:00 GMTsoftwaremicroservicesdora-metricshttps://portfolio.hagzag.com/blog/mise-en-place/https://portfolio.hagzag.com/blog/mise-en-place/Mon, 04 Apr 2022 05:00:00 GMTsoftwaremicroservicesdora-metricshttps://portfolio.hagzag.com/blog/scoutesuite/https://portfolio.hagzag.com/blog/scoutesuite/Mon, 04 Apr 2022 05:00:00 GMTsoftwaremicroservicesdora-metricshttps://portfolio.hagzag.com/blog/youtube/sor8enm6anm/https://portfolio.hagzag.com/blog/youtube/sor8enm6anm/Wed, 30 Mar 2022 19:21:00 GMTmeetupYoutubedevexhttps://portfolio.hagzag.com/blog/medium/upskillin-the-dev-in-devops/https://portfolio.hagzag.com/blog/medium/upskillin-the-dev-in-devops/Why DevOps engineers must deepen their software engineering craft and how to plan the skills journey.Sat, 26 Feb 2022 11:14:36 GMTdevopsCareerEngineeringhttps://portfolio.hagzag.com/blog/youtube/1comqo-im6w/https://portfolio.hagzag.com/blog/youtube/1comqo-im6w/Tue, 22 Feb 2022 09:21:00 GMTmeetupYoutubedevexk3sk3dhttps://portfolio.hagzag.com/blog/youtube/6iuxdfwkx0y/https://portfolio.hagzag.com/blog/youtube/6iuxdfwkx0y/Tue, 22 Feb 2022 09:21:00 GMTmeetupYoutubedevexVagrantChefhttps://portfolio.hagzag.com/blog/youtube/lxxnwud6x3k/https://portfolio.hagzag.com/blog/youtube/lxxnwud6x3k/Tue, 22 Feb 2022 09:21:00 GMTmeetupYoutubedevexVagrantChefhttps://portfolio.hagzag.com/blog/youtube/nakkz_qdzk4/https://portfolio.hagzag.com/blog/youtube/nakkz_qdzk4/Mon, 17 Jan 2022 09:21:00 GMTProduction ReadinessYoutubeTechRadarConhttps://portfolio.hagzag.com/blog/medium/decex-techradrdcon/https://portfolio.hagzag.com/blog/medium/decex-techradrdcon/Wed, 15 Dec 2021 05:00:00 GMTdotfilesconfigdevexhttps://portfolio.hagzag.com/blog/webminar-03214/https://portfolio.hagzag.com/blog/webminar-03214/Tue, 20 Jul 2021 07:23:00 GMTtoildevexhttps://portfolio.hagzag.com/blog/youtube/5wqotc2mlim/https://portfolio.hagzag.com/blog/youtube/5wqotc2mlim/Wed, 04 Mar 2020 09:21:00 GMTWebinarProduction ReadinessYoutubehttps://portfolio.hagzag.com/blog/youtube/7krxvtpb3to/https://portfolio.hagzag.com/blog/youtube/7krxvtpb3to/Wed, 04 Mar 2020 09:21:00 GMTWebinarProduction ReadinessYoutubehttps://portfolio.hagzag.com/blog/youtube/kqrysdfevec/https://portfolio.hagzag.com/blog/youtube/kqrysdfevec/Sun, 28 Jul 2019 09:21:00 GMTWebinarProduction ReadinessYoutubehttps://portfolio.hagzag.com/blog/youtube/1jbl2l-mrl4/https://portfolio.hagzag.com/blog/youtube/1jbl2l-mrl4/Mon, 22 Jul 2019 07:23:00 GMTChaos Engineeringdevexhttps://portfolio.hagzag.com/blog/youtube/ewsdhvc8f5m/https://portfolio.hagzag.com/blog/youtube/ewsdhvc8f5m/Mon, 22 Jul 2019 07:23:00 GMTChaos Engineeringdevexmeetuphttps://portfolio.hagzag.com/blog/youtube/ssphtus4tii/https://portfolio.hagzag.com/blog/youtube/ssphtus4tii/Mon, 19 Mar 2018 09:21:00 GMTProduction ReadinessYoutubeminikubehttps://portfolio.hagzag.com/blog/youtube/pxfkzhpyq0q/https://portfolio.hagzag.com/blog/youtube/pxfkzhpyq0q/Mon, 19 Mar 2018 09:21:00 GMTProduction ReadinessYoutubeTechRadarConhttps://portfolio.hagzag.com/blog/youtube/xzi16ltohmo/https://portfolio.hagzag.com/blog/youtube/xzi16ltohmo/Sat, 28 Mar 2009 07:23:00 GMTWebinarProduction Readinesshttps://portfolio.hagzag.com/blog/youtube/0panapw7bui/https://portfolio.hagzag.com/blog/youtube/0panapw7bui/Wed, 04 Feb 2004 09:21:00 GMTmeetupYoutubedevexVagrantChefhttps://portfolio.hagzag.com/blog/youtube/5z3ryoxr8tm/https://portfolio.hagzag.com/blog/youtube/5z3ryoxr8tm/Wed, 04 Feb 2004 09:21:00 GMTmeetupYoutubedevexVagrantChef