Practitioner notes on SRE, Platform Engineering, Kubernetes, and how AI changes the way we ship. DevOps, SRE, Platform Engineering, and AI-driven delivery — by Haggai Philip Zagury.
One poisoned note, one bucket, five labs. mTLS, SPIFFE identity, delegated permits, a sandbox and a signed audit trail, each shown breaking before it holds.
Companies across the globe—and Israeli high-tech especially—are mass-laying off in the name of AI. But is AI really the reason, or just the best available excuse?
A short note on why I refreshed the 5-part SOC 2 for ISVs series in 2026 — modernized imagery, and a reset of my own field knowledge from +-5-7 years of customer engagements.
Pod logs named a human who never logged in. A signed, hash-chained audit trail replays the same crash and names the human, the agent and the task, and catches the insider who edits it.
A code-running agent tool inherits its pod's blast radius. NetworkPolicy, a dropped ServiceAccount token and gVisor shrink it — and a blast-radius report shows which layers actually hold.
A signed task proves who wrote it, not who allowed it. RFC 8693 permits with sub, act, scope and a 120s TTL, checked by OPA at the MCP gateway.
mTLS ends at the queue. SPIRE-issued identities and JWS-signed tasks stop forgery and tampering. A k3d lab shows what they still can't stop.
Autonomous agents on a bumpy network crash with no one to blame. mTLS paves the road, but it can't tell you who's driving. A k3d lab shows both.
In June I asked whether Anthropic's warning was a brake pedal or a press release. The essay arrived — and it's a real mechanism, aimed one layer above where most of us actually ship agents.
Over $1,200/month across Cursor and Claude, after already running Headroom and Ponytail. Here's why cheaper tokens aren't producing cheaper bills, and what that means for 2027 budgets.
AI didn't just accelerate compliance work — it introduced a parallel standards stack. Here's what EU AI Act, NIST AI RMF, and ISO/IEC 42001 actually require, and how large organizations implement them.
One compromised maintainer, 444+ packages, ~2B monthly installs. What the Shai-Hulud npm worm teaches platform teams about install-time trust — and how to harden against the next one.
K3's launch proved the model was the easy part. A capacity crunch, a QoS-driven plan split, and why open weights turn build-vs-buy into the real platform decision.
Kimi K3's 2.8T-parameter architecture from the infrastructure side — sparse MoE, Kimi Delta Attention, attention residuals, and why cost-per-task beats the sticker price.
Benchmarks say the harness changes the score. A consultant's take: pick the harness you can leave, and make your skills portable across all of them.