Space
Security
Identity, PKI, secrets delivery, hardening, and trust boundaries.
Posts
All posts- A Certificate Delivery Bridge Between Argo CD and Non-AWS ClustersHow a hub-issued Argo CD Agent certificate crosses an AWS Secrets Manager boundary through ESO PushSecret and ExternalSecret, without giving the non-AWS spoke ACM Private CA access.
- When Argo CD Login Loops Forever: The argocd-agent Redis Proxy NetworkPolicy TrapDebugging an Argo CD login loop on a hub-and-spoke argocd-agent setup — from an OIDC callback loop and i/o timeouts down to a cross-chart NetworkPolicy gap that only bit us where enforcement was actually on.
- One Trust Anchor Per Cluster: Hardening Non-AWS Spoke Identity with IAM Roles AnywhereHow we gave RKE2/bare-metal spokes their own AWS identity without a shared trust anchor — one self-signed CA and anchor per cluster, one profile per role — so a stolen key is confined to its own cluster and a compromised consumer to its own role.