Writing

Long-form notes on Go, infrastructure and the CNCF projects I work in, with the real code and the tradeoffs. Sometimes a career lesson too.

~/Writing

All tech golang infra opensource ideology security observability prometheus web3

2026

  1. Observability That Actually Helps at 3am

    2026-05-27 · 8 min

    Wiring OpenTelemetry traces, metrics, and logs into Prometheus and Grafana across microservices. The one move that matters (trace IDs in every log line), and the cardinality, sampling, and clock-skew traps that waste your time.

    infraobservability

  2. Service-to-Service Auth From Scratch, and the Five Things That Bite You

    2026-04-15 · 11 min

    How internal microservices actually prove who they are to each other: OAuth2 client-credentials with Keycloak and OIDC, JWT validation via JWKS, and the clock-skew, key-rotation, and audience traps nobody warns you about.

    infrasecurity

  3. The Right Tool in the Wrong Runtime: Querying Cloud Cost Data with DuckDB

    2026-02-24 · 8 min

    Building a cloud cost-reporting pipeline over Oracle CUR data: from a managed warehouse, to DuckDB in a serverless function that hit a ~200MB memory wall, to a long-lived VM query service. A lesson about separating the tool from where you run it.

    infratech

2025

  1. What Hardening a Container Image Actually Removes

    2025-03-11 · 10 min

    Most CVEs in your container image aren't in your code. Hardening 12+ OSS images (including IronBank/DoD) taught me the real move: cut CVEs ~80% by removing packages you never used, not by patching.

    infrasecurity