Blog

I run a simulated insurer's IS with Authentik as the single sign-on provider — one login for everything. So why did I just bolt an LDAP server onto it for the second time? Because SSO answers one question, and twice I needed a different one. Here's the root cause, and the rule that tells you in advance which protocol you actually need.

An insurance company doesn't run by hiring people and letting each department decide how to work. It runs on a framework of policies, standards, guidelines, procedures and controls. I built that framework for my simulated insurer — 15 governance books, 80 pages, wired to the business apps — and learned that the hard part isn't writing the rules. It's keeping the human rule, the executable rule and the engineering decision as one thing.

I run a simulated insurer's IS on Kubernetes, built as separate services per domain. Then I stopped and asked the uncomfortable question: is that the right architecture, or just the fashionable one? This is the decision I made — modular-monolith-first — and, more usefully, the decision I deliberately did NOT make: building the thing at all, yet.

Everyone is talking about smarter models. Almost nobody talks about the harness — the rules, memory, guardrails and verification loops that sit around the model and decide whether it ships reliable work or plausible garbage. This is the harness I built so an AI agent can operate on the ktayl-solution information system without breaking prod.

It's tempting to delete the backup server and push everything to cheap cloud object storage. On the ktayl-solution platform I decided not to — and an hour later I fat-fingered a bucket delete that proved exactly why. This is the reasoning behind keeping a local MinIO alongside Cloudflare R2, and where the cloud instinct is actually right.

GitOps reconciles everything inside the cluster — but not the operating system beneath it. This is how minicloud-ansible codifies the node-level prerequisites (iSCSI, multipath, registry mirrors, default routes, CIS hardening) so any node can be reimaged or added with a single idempotent playbook run.

A disk filled up. Then cluster DNS died. Then storage volumes refused to rebuild. The obvious cause was a symptom — the real culprit was a bloated SQLite write-ahead log starving the storage layer. Here is the full debugging trail, the fix, and the prevention that shipped afterward.

How a self-hosted Harbor instance, configured as a pull-through proxy for docker.io, ghcr.io, quay.io, and registry.k8s.io, becomes the single entry point for all image traffic on a bare-metal k3s cluster — eliminating Docker Hub rate limits, centralizing vulnerability scanning, and keeping air-gap capability without any code changes in your manifests.

Service accounts, robot accounts, break-glass tokens, OAuth2 client credentials, API keys — a self-hosted Kubernetes platform uses all of them. Here is how they differ, why each one exists, and what happens when you lose track of one.