Trivy Scanned My Compromised Server This Morning. It Found Two OpenSSL Bugs.

October 2026: the scanner was healthy, up to date, and looking straight at it.

Last weekend I finally got around to a project that sat on the backburner for months: proper vulnerability scanning for the cluster. Trivy Operator, a built-in server so scans avoid re-downloading the vulnerability database every run, a UI, alert rules, and an accepted-risk register with review dates. The works. I felt pretty good about it. The cluster was finally observed.

119 commits in one day: what happens when AI meets GitOps without guardrails

January 2026 — a post-mortem on why your branch protections mean absolutely nothing when an AI is at the wheel

---

It started with a reasonable idea

I run a self-hosted Kubernetes cluster. FluxCD manages the entire thing — GitOps, reconciliation loops, the works. Git is the source of truth. It’s a clean, elegant system. You push to main, the cluster updates. Simple.

Certificate governance without the ceremony: cert-manager + Venafi on k3s

December 2022 — because PKI shouldn’t require a JIRA ticket and three approvals

There’s a version of certificate management that lives in large enterprises. You file a request. A team reviews it. Someone checks a compliance box. Five days later, a certificate lands in your inbox as a .pfx file. You paste it into a UI. Two weeks from now it expires and nobody notices until a monitoring alert fires at 2am.