https://franroa.github.io/platform-engineer/writing.html Platform engineering from practice: Terraform at scale, multi-tenant Kubernetes, AI platforms and agent workflows. en Thu, 16 Jul 2026 22:00:00 GMT https://franroa.github.io/platform-engineer/writing.html#read=blog-marketplace https://franroa.github.io/platform-engineer/writing.html#read=blog-marketplace Assistant skills drift and fork like dotfiles. Moving every skill, agent and hook into a local plugin marketplace — versioned plugins, symlinked single source, installed per session — makes every future session consistent. Thu, 16 Jul 2026 22:00:00 GMT SkillsWorkflowAI https://franroa.github.io/platform-engineer/writing.html#read=blog-disaster-recovery https://franroa.github.io/platform-engineer/writing.html#read=blog-disaster-recovery Region loss as a scheduled event: critical data already lives in a second geography, one region pair is the designated restore target, and a weekly pipeline rehearses the restore into an isolated resource group and asserts the data is usable. Thu, 16 Jul 2026 22:00:00 GMT BackupsPlatformWell-Architected https://franroa.github.io/platform-engineer/writing.html#read=blog-backups https://franroa.github.io/platform-engineer/writing.html#read=blog-backups One tag — data_criticality — routes every resource to the right vault pair: GeoZone-redundant with paired-region restore for critical, Zone-redundant for important. DINE policies and daily discovery enforce enrolment; nobody files a backup ticket. Thu, 16 Jul 2026 22:00:00 GMT BackupsPlatformSecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-ai-gateway https://franroa.github.io/platform-engineer/writing.html#read=blog-ai-gateway Model keys never leave the platform: every AI call goes through a GenAI gateway — per-app subscription keys, hard token budgets, per-app×model metering, managed identity to the backend. Clients change one line: base_url. Wed, 15 Jul 2026 22:00:00 GMT AISecurityPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-blender-mcp https://franroa.github.io/platform-engineer/writing.html#read=blog-blender-mcp blender-mcp wires an MCP server into Blender so an assistant can drive the modeling tool directly from plain language. The interesting part isn't the demo — it's who gets to touch 3D work now. Wed, 15 Jul 2026 22:00:00 GMT DesignAI https://franroa.github.io/platform-engineer/writing.html#read=blog-failure-modes https://franroa.github.io/platform-engineer/writing.html#read=blog-failure-modes Delete a box from the diagram and read what's left. Ask it of the hub, the ONE gateway, a whole region — the answer is either a design property (a PDB, a cell boundary, run-once placement) or a war story. War stories are findings. Tue, 14 Jul 2026 22:00:00 GMT Well-ArchitectedKubernetesPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-traefik-oauth https://franroa.github.io/platform-engineer/writing.html#read=blog-traefik-oauth Move the OAuth dance out of the apps: one shared Traefik gateway, and an oauth2-proxy that fronts each tenant app — as forwardAuth middleware, or as this platform's default: a sidecar with per-tenant client, cookie and blast radius. Mon, 13 Jul 2026 22:00:00 GMT SecurityKubernetesMulti-tenancy https://franroa.github.io/platform-engineer/writing.html#read=blog-sidecar-patterns https://franroa.github.io/platform-engineer/writing.html#read=blog-sidecar-patterns Sidecar, ambassador, adapter — where this platform uses each (oauth2-proxy, Dapr, OTel), what a sidecar really costs, and the rule for when a DaemonSet beats N sidecars. Mon, 13 Jul 2026 22:00:00 GMT KubernetesFundamentals https://franroa.github.io/platform-engineer/writing.html#read=blog-finops-cost-gates https://franroa.github.io/platform-engineer/writing.html#read=blog-finops-cost-gates A billing review three weeks after the merge is archaeology. Price the Terraform plan in the MR (Infracost), meter reality in the cluster (OpenCost), and gate like the safety gate — feedback loop first, hard block only for the GPU-sized risks. Mon, 13 Jul 2026 22:00:00 GMT FinOpsPlatformTerraform https://franroa.github.io/platform-engineer/writing.html#read=blog-finops-governance https://franroa.github.io/platform-engineer/writing.html#read=blog-finops-governance Not a dashboard — a cycle: estimate at plan time, meter at runtime, standardize the metric so every cloud reports cost in the same shape. Plus the honest caveats: labels are the weakest link, and the integration needs an owner or it rots. Mon, 13 Jul 2026 22:00:00 GMT FinOpsKubernetesObservability https://franroa.github.io/platform-engineer/writing.html#read=blog-golden-paths-fail https://franroa.github.io/platform-engineer/writing.html#read=blog-golden-paths-fail The predictable failure modes — too many choices, one template for every workload, abandonment, no escape hatches — and the two metrics that matter: retention and bypass rate. Run the path as a product, not a launch. Mon, 13 Jul 2026 22:00:00 GMT PlatformReuseWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-mcp-assistant https://franroa.github.io/platform-engineer/writing.html#read=blog-mcp-assistant The useful assistant is an LLM with standardized read-only taps into git, metrics, cluster state and runbooks — evidence over eloquence, RBAC inherited, every request audited. MCP just makes the plumbing boring. Mon, 13 Jul 2026 22:00:00 GMT AIPlatformWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-writing-plans https://franroa.github.io/platform-engineer/writing.html#read=blog-writing-plans A plan is the cheapest place to be wrong. Write it so a reviewer can kill the mistake before any code exists — name the exact files and edits, put the verification in the plan, and spend most of your words on what you will not do. Sun, 12 Jul 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-reviewing-plans https://franroa.github.io/platform-engineer/writing.html#read=blog-reviewing-plans Reviewing a plan beats reviewing the diff: a wrong assumption costs a sentence here and a rewrite there. Review the approach, the blast radius, the missing states and the escape hatch — then approve narrowly. Sun, 12 Jul 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-writing-skills https://franroa.github.io/platform-engineer/writing.html#read=blog-writing-skills A skill is the paved road for an agent — encode your conventions once instead of re-explaining them every session. One job, a description written to trigger it, the whole ceremony, and guardrails that bite. Sun, 12 Jul 2026 22:00:00 GMT SkillsWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-reviewing-skills https://franroa.github.io/platform-engineer/writing.html#read=blog-reviewing-skills You do not lint a skill, you taste-test it: does the description make it trigger at the right moment, do the steps survive a literal agent, and do the guardrails actually stop the failure you fear? Sun, 12 Jul 2026 22:00:00 GMT SkillsWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-dns https://franroa.github.io/platform-engineer/writing.html#read=blog-dns Names as infrastructure: private zones so services resolve over the inspected path, records generated from live ingresses, and TTLs chosen as a consistency knob rather than inherited. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsNetworking https://franroa.github.io/platform-engineer/writing.html#read=blog-tls-rotation https://franroa.github.io/platform-engineer/writing.html#read=blog-tls-rotation Certificates are time bombs with friendly names. Issue and renew them with a controller, make the rotation actually reach the pods, and terminate where your controls can read the request. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsSecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-load-balancing https://franroa.github.io/platform-engineer/writing.html#read=blog-load-balancing "Load balancer" names two different machines: L4 spreads connections by tuple, L7 routes on the request. Most routing pain is asking L4 a question only L7 can answer. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsNetworking https://franroa.github.io/platform-engineer/writing.html#read=blog-slo-error-budgets https://franroa.github.io/platform-engineer/writing.html#read=blog-slo-error-budgets An SLI measures what users feel, an SLO is the target, and the error budget is a currency: spend it on releases when there is budget, stop and harden when there is not. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsObservability https://franroa.github.io/platform-engineer/writing.html#read=blog-progressive-delivery https://franroa.github.io/platform-engineer/writing.html#read=blog-progressive-delivery A deploy is a bet the new version works. Progressive delivery keeps most of the stake back — traffic-splitting plus a health signal, with rollback as the feature, not the fallback. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsKubernetes https://franroa.github.io/platform-engineer/writing.html#read=blog-defense-in-depth https://franroa.github.io/platform-engineer/writing.html#read=blog-defense-in-depth Security that needs one control to never fail is a countdown to a breach. Stack independent envelopes — identity, network, policy — so getting through one buys an attacker almost nothing. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsSecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-twelve-factor https://franroa.github.io/platform-engineer/writing.html#read=blog-twelve-factor The platform enforces most of the twelve so the app team gets them for free: config from a vault, stateless pods, logs as streams, disposability by default. Discipline becomes the shape of the paved road. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-osi-model https://franroa.github.io/platform-engineer/writing.html#read=blog-osi-model Seven layers as a map of where a decision belongs: packet filtering at L3/4, load balancing at L4, routing and policy at L7, names resolved privately underneath. The layer tells you which repo to open. Sun, 12 Jul 2026 22:00:00 GMT FundamentalsNetworking https://franroa.github.io/platform-engineer/writing.html#read=blog-immutability https://franroa.github.io/platform-engineer/writing.html#read=blog-immutability Every manual hot-fix is drift the code doesn't know about — and a box you can no longer rebuild. Immutable infrastructure removes the temptation by removing the door: change the code, roll a new one. Sat, 11 Jul 2026 22:00:00 GMT FundamentalsSecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-replace-dont-repair https://franroa.github.io/platform-engineer/writing.html#read=blog-replace-dont-repair Repairing a live instance is a bespoke, unrepeatable act that leaves you a slightly different system. Replacing it from code is boring, automatic and identical every time — which is why the platform does it for you. Sat, 11 Jul 2026 22:00:00 GMT FundamentalsKubernetes https://franroa.github.io/platform-engineer/writing.html#read=blog-idempotency https://franroa.github.io/platform-engineer/writing.html#read=blog-idempotency The quiet property that makes a platform safe to automate: Terraform applies to the same result, Argo CD syncs on a loop, a failed pipeline is just re-run. Without it every retry is a gamble. Sat, 11 Jul 2026 22:00:00 GMT FundamentalsIaC https://franroa.github.io/platform-engineer/writing.html#read=blog-cap-theorem https://franroa.github.io/platform-engineer/writing.html#read=blog-cap-theorem CAP isn't a whiteboard abstraction — you make the call every time you decide where data lives. Regional-by-default placement, per tenant-region secrets, and "global" reserved for what tolerates lag. Sat, 11 Jul 2026 22:00:00 GMT FundamentalsMulti-tenancy https://franroa.github.io/platform-engineer/writing.html#read=blog-well-architected https://franroa.github.io/platform-engineer/writing.html#read=blog-well-architected The five pillars audited against a running platform — each answered with a mechanism you can click: reliability that rebuilds from code, three security envelopes, budgets with owners, a paved road, and capacity as a decision. Fri, 10 Jul 2026 22:00:00 GMT Well-ArchitectedPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-gitlab-migration https://franroa.github.io/platform-engineer/writing.html#read=blog-gitlab-migration Three independent migrations — users, repositories, artifacts — all asynchronous, so verify jobs, not calls. Plus the two coordination rules that save the cut-over: a freeze period and an immediate origin switch. Thu, 09 Jul 2026 22:00:00 GMT MigrationPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-terraform https://franroa.github.io/platform-engineer/writing.html#read=blog-terraform Why "one repo per concern, one scope per resource" beats a mono-state, and how an OPA gate makes apply boring. Tue, 07 Jul 2026 22:00:00 GMT TerraformIaCPlatformWell-Architected https://franroa.github.io/platform-engineer/writing.html#read=blog-kubernetes https://franroa.github.io/platform-engineer/writing.html#read=blog-kubernetes Namespaces as code, dedicated node pools, and why a tenant's data deliberately lives where the tenant can't delete it. Thu, 02 Jul 2026 22:00:00 GMT KubernetesMulti-tenancy https://franroa.github.io/platform-engineer/writing.html#read=blog-ai-platform https://franroa.github.io/platform-engineer/writing.html#read=blog-ai-platform Grounding assistants in the platform's own knowledge graph and live state instead of hoping the model guesses right. Sat, 27 Jun 2026 22:00:00 GMT AIRAG https://franroa.github.io/platform-engineer/writing.html#read=blog-tenant-keyvaults https://franroa.github.io/platform-engineer/writing.html#read=blog-tenant-keyvaults One Key Vault per tenant per region — deliberately placed in a platform-owned resource group, so a tenant can use its secrets but never destroy the vault. Mon, 22 Jun 2026 22:00:00 GMT SecurityMulti-tenancyWell-Architected https://franroa.github.io/platform-engineer/writing.html#read=blog-tenant-isolation https://franroa.github.io/platform-engineer/writing.html#read=blog-tenant-isolation Tenants are isolated cells: near-admin inside, zero power outside, and no way to grant yourself in. A cross-tenant role-assignment 403 is that boundary made visible — not a missing permission. Wed, 17 Jun 2026 22:00:00 GMT Multi-tenancySecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-gitlab-runners https://franroa.github.io/platform-engineer/writing.html#read=blog-gitlab-runners GitLab is configured per tenant; the env vars pin each runner to a managed identity that can assign permissions only in its own tenant. The configuration is the security boundary — and the platform owns it. Fri, 12 Jun 2026 22:00:00 GMT IdentityMulti-tenancy https://franroa.github.io/platform-engineer/writing.html#read=blog-storage-proxy https://franroa.github.io/platform-engineer/writing.html#read=blog-storage-proxy SAS tokens are long-lived, over-scoped bearer credentials you can't individually revoke — so clients never get one. A storage proxy authenticates with a managed identity, scopes each request, and can be cut off in one place. Sun, 07 Jun 2026 22:00:00 GMT SecurityIdentity https://franroa.github.io/platform-engineer/writing.html#read=blog-reuse-libraries https://franroa.github.io/platform-engineer/writing.html#read=blog-reuse-libraries Terraform modules, Helm charts and GitLab CI components — one reuse grammar (reference + version, never copy) with the OPA policy pack riding inside. Tue, 02 Jun 2026 22:00:00 GMT PlatformReuse https://franroa.github.io/platform-engineer/writing.html#read=blog-golden-path https://franroa.github.io/platform-engineer/writing.html#read=blog-golden-path A new service composes a pipeline component, Terraform modules and Helm charts — the paved road where doing it right is also the shortest route. Thu, 28 May 2026 22:00:00 GMT PlatformReuseWell-Architected https://franroa.github.io/platform-engineer/writing.html#read=blog-otel-operator https://franroa.github.io/platform-engineer/writing.html#read=blog-otel-operator A design note: collectors and auto-instrumentation as CRDs, so tenants inherit traces from their namespace instead of wiring SDKs by hand. Sat, 23 May 2026 22:00:00 GMT ObservabilityKubernetes https://franroa.github.io/platform-engineer/writing.html#read=blog-access-as-code https://franroa.github.io/platform-engineer/writing.html#read=blog-access-as-code PIM-activated humans, standing operator identities for automation, membership as YAML merge requests, and secretless OIDC for CI. Mon, 18 May 2026 22:00:00 GMT SecurityIdentity https://franroa.github.io/platform-engineer/writing.html#read=blog-azure-email https://franroa.github.io/platform-engineer/writing.html#read=blog-azure-email One shared email relay, one sender identity per tool — and a DKIM check inside every message that cryptographically proves its origin. Wed, 13 May 2026 22:00:00 GMT SecurityPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-cockpit https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-cockpit A which-key agent leader in tmux and agentsview — reading each session’s context fill from its transcript, so observing agents is free. Fri, 08 May 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-claude-signals https://franroa.github.io/platform-engineer/writing.html#read=blog-claude-signals Lifecycle hooks write per-session status files; the statusline spins while agents work and blinks when they need you — with GitLab events in the same strip. Sun, 03 May 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-of-empires https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-of-empires Each unit of work is a session with its own git worktree, an explicit identity profile, and — when trust is low — a sandbox. Tenancy ideas, applied to agents. Tue, 28 Apr 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-local-remote-ci https://franroa.github.io/platform-engineer/writing.html#read=blog-local-remote-ci Local CI runs byte-identical to remote, a one-key diff that makes every divergence auditable, and a poller that watches the real pipeline after push. Thu, 23 Apr 2026 22:00:00 GMT WorkflowPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-skills https://franroa.github.io/platform-engineer/writing.html#read=blog-agent-skills Versioned, reviewable procedures the agent loads on demand — MR conventions, test-driven CI loops. The paved-road idea, applied to AI. Sat, 18 Apr 2026 22:00:00 GMT SkillsWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-yas-wrapper https://franroa.github.io/platform-engineer/writing.html#read=blog-yas-wrapper yet-another-statusline, untouched, plus a wrapper that splices in 📄 context files, 🧠 memory, the profile identity and a 🐳 sandbox badge. Mon, 13 Apr 2026 22:00:00 GMT Workflow https://franroa.github.io/platform-engineer/writing.html#read=blog-synapse-skills https://franroa.github.io/platform-engineer/writing.html#read=blog-synapse-skills Personal skills organised as plugins in a local marketplace: working-on-ticket ceremonies, GitLab pipeline setup, CI watching, git guardrails. Wed, 08 Apr 2026 22:00:00 GMT SkillsWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-sandboxing-claude https://franroa.github.io/platform-engineer/writing.html#read=blog-sandboxing-claude Docker sandboxes vs nono vs agent-cage — filesystem, permissions or egress — and my own: sandboxes + profile mounts + an Obsidian vault as the dynamic context bus. Fri, 03 Apr 2026 22:00:00 GMT WorkflowSecurity https://franroa.github.io/platform-engineer/writing.html#read=blog-secure-sandbox https://franroa.github.io/platform-engineer/writing.html#read=blog-secure-sandbox I audited my agent runner’s sandbox and filed four upstream issues — least capability, least network, validated mounts, ephemeral credentials. Sun, 29 Mar 2026 22:00:00 GMT SecurityWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-info-filtering https://franroa.github.io/platform-engineer/writing.html#read=blog-info-filtering An RSS list fetched by an agent that scores every item against an interest profile written as a markdown note — and delivers a prioritized digest into my vault. Tue, 24 Mar 2026 23:00:00 GMT Information and LearningWorkflow https://franroa.github.io/platform-engineer/writing.html#read=blog-grafana-cloud https://franroa.github.io/platform-engineer/writing.html#read=blog-grafana-cloud Keep the opinionated half — collectors, tenancy labels, dashboards-as-code — and pay someone else to run Mimir at 3 a.m. Tenancy labels ARE the cost model. Thu, 19 Mar 2026 23:00:00 GMT Observability https://franroa.github.io/platform-engineer/writing.html#read=blog-grafana-cloud-migration https://franroa.github.io/platform-engineer/writing.html#read=blog-grafana-cloud-migration Dual-write at the agents, migrate the readers, starve the old stack — and the three things that actually bit: cardinality, retention, auth. Sat, 14 Mar 2026 23:00:00 GMT ObservabilityMigration https://franroa.github.io/platform-engineer/writing.html#read=blog-migration-onprem-cloud https://franroa.github.io/platform-engineer/writing.html#read=blog-migration-onprem-cloud Guardrails first, workloads through the golden path, and an old environment that gets starved rather than switched off. Mon, 09 Mar 2026 23:00:00 GMT MigrationPlatform https://franroa.github.io/platform-engineer/writing.html#read=blog-migration-subscriptions https://franroa.github.io/platform-engineer/writing.html#read=blog-migration-subscriptions Same cloud, same code, different boundary: recreate the scope, repoint state/identity/DNS/peering, dual-run until the diff is only intentional. Wed, 04 Mar 2026 23:00:00 GMT MigrationTerraform https://franroa.github.io/platform-engineer/writing.html#read=landscape-index https://franroa.github.io/platform-engineer/writing.html#read=landscape-index Not a logo wall: every tool runs in the platform today, earns its place, and is GitOps-delivered by cluster class — base everywhere, hub extras once, dev tooling never in live. Fri, 27 Feb 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=res-cert-manager https://franroa.github.io/platform-engineer/writing.html#read=res-cert-manager CSR → issue → store → renew before expiry, reconciled by a controller instead of a human — installed first among cluster services because everything with a hostname depends on it. Wed, 25 Feb 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-argocd https://franroa.github.io/platform-engineer/writing.html#read=landscape-argocd App-of-apps per cluster, drift as a dashboard state, no kubectl in pipelines — and Argo manages Argo, so terraform only seeds the first install. Mon, 23 Feb 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-kyverno https://franroa.github.io/platform-engineer/writing.html#read=landscape-kyverno Validate, mutate, generate — the runtime half of the policy gate, sync-waved at −2 so admission policy exists before the first tenant namespace ever syncs. Thu, 19 Feb 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-external-secrets https://franroa.github.io/platform-engineer/writing.html#read=landscape-external-secrets Key Vault → Kubernetes secrets without a person in the loop; workloads reference ExternalSecret outputs on their very first sync. Sun, 15 Feb 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-reloader https://franroa.github.io/platform-engineer/writing.html#read=landscape-reloader A rotated secret restarts the pods that mount it — closing the last mile of External Secrets so rotation is real, not cosmetic. Wed, 11 Feb 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-external-dns https://franroa.github.io/platform-engineer/writing.html#read=landscape-external-dns Watches the HTTPRoutes tenants create and reconciles the platform DNS zone — nobody files a ticket for a CNAME. Sat, 07 Feb 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-keda https://franroa.github.io/platform-engineer/writing.html#read=landscape-keda Queues and events instead of CPU guesses, including scale-to-zero — event-driven autoscaling every tenant inherits. Tue, 03 Feb 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-karpenter https://franroa.github.io/platform-engineer/writing.html#read=landscape-karpenter Provisioned in seconds, consolidated when idle: system pools stay terraform-owned, burst capacity is Karpenter-owned. Thu, 29 Jan 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-opentelemetry https://franroa.github.io/platform-engineer/writing.html#read=landscape-opentelemetry One collector per cluster (daemonset + gateway): tenants instrument once against OTLP and the platform decides where telemetry lands. Sun, 25 Jan 2026 23:00:00 GMT K8s ServicesKubernetesObservability https://franroa.github.io/platform-engineer/writing.html#read=landscape-grafana https://franroa.github.io/platform-engineer/writing.html#read=landscape-grafana Dashboards, alerts and Explore as code over Mimir & Loki — hub-only by design: regional clusters ship telemetry, they don't each run a dashboard stack. Wed, 21 Jan 2026 23:00:00 GMT K8s ServicesKubernetesObservability https://franroa.github.io/platform-engineer/writing.html#read=landscape-telepresence https://franroa.github.io/platform-engineer/writing.html#read=landscape-telepresence Intercept a Service from the laptop — a sandbox-cluster feature by placement, because the same trick in live is an incident. Sat, 17 Jan 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-backstage https://franroa.github.io/platform-engineer/writing.html#read=landscape-backstage Software catalog, golden-path scaffolder and TechDocs — hub-only: one catalog, one scaffolder, backed by the postgresql-k8s module. Tue, 13 Jan 2026 23:00:00 GMT K8s ServicesKubernetesPlatform https://franroa.github.io/platform-engineer/writing.html#read=landscape-buildpacks https://franroa.github.io/platform-engineer/writing.html#read=landscape-buildpacks kpack turns source into an OCI image on the hardened base without a hand-written Dockerfile — one builder to patch, not one Dockerfile per repo. Sun, 11 Jan 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-trivy https://franroa.github.io/platform-engineer/writing.html#read=landscape-trivy Scans every running workload on a schedule — so a CVE disclosed the day after a deploy is caught, not just the one that existed at build time. Sat, 10 Jan 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-policy-reporter https://franroa.github.io/platform-engineer/writing.html#read=landscape-policy-reporter Reads the PolicyReport CRDs Kyverno and Trivy already emit and turns them into one UI plus Slack/Teams alerts — a standard, not a custom exporter. Thu, 08 Jan 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-opencost https://franroa.github.io/platform-engineer/writing.html#read=landscape-opencost Cost per namespace and workload from real requests/usage against actual pricing — the number behind "~90% cost cut," visible to anyone on the platform. Tue, 06 Jan 2026 23:00:00 GMT K8s ServicesKubernetesFinOps https://franroa.github.io/platform-engineer/writing.html#read=security-opa https://franroa.github.io/platform-engineer/writing.html#read=security-opa A plan → OPA evaluation → apply safety gate, composable per cloud provider — the safe choice (paranoid/high/standard) is the default, not an opt-in. Mon, 05 Jan 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-falco https://franroa.github.io/platform-engineer/writing.html#read=landscape-falco eBPF syscall watching for what admission policy and image scans can't see — a shell spawned inside a container, a write to /etc/shadow, an unexpected connection. Sun, 04 Jan 2026 23:00:00 GMT K8s ServicesKubernetesSecurity https://franroa.github.io/platform-engineer/writing.html#read=landscape-litmus https://franroa.github.io/platform-engineer/writing.html#read=landscape-litmus Controlled failure to prove resilience claims instead of hoping them — every experiment is a reviewed ChaosEngine CRD, scoped to one namespace, opt-in only. Sat, 03 Jan 2026 23:00:00 GMT K8s ServicesKubernetes https://franroa.github.io/platform-engineer/writing.html#read=landscape-openfeature https://franroa.github.io/platform-engineer/writing.html#read=landscape-openfeature A vendor-neutral feature-flag spec + SDK backed by flagd in-cluster — dark-launch a feature before it's a canary rollout, not after. Fri, 02 Jan 2026 23:00:00 GMT K8s ServicesKubernetesPlatform https://franroa.github.io/platform-engineer/writing.html#read=landscape-cilium https://franroa.github.io/platform-engineer/writing.html#read=landscape-cilium Azure CNI powered by Cilium: eBPF dataplane set at cluster creation, not a Helm chart installed after — L3-L7 network policy and Hubble visibility in one dataplane's job. Thu, 01 Jan 2026 23:00:00 GMT K8s ServicesKubernetesNetworking https://franroa.github.io/platform-engineer/writing.html#read=landscape-dapr https://franroa.github.io/platform-engineer/writing.html#read=landscape-dapr Pub/sub, state, service invocation and durable workflow over one sidecar API — the durable-workflow primitive agentic AI pipelines need without hand-rolling it. Wed, 31 Dec 2025 23:00:00 GMT K8s ServicesKubernetesAI https://franroa.github.io/platform-engineer/writing.html#read=landscape-traefik https://franroa.github.io/platform-engineer/writing.html#read=landscape-traefik Exactly ONE gateway instance per cluster, platform-owned; tenants attach namespace-scoped HTTPRoutes by parentRef and never run their own ingress — SSO rides as an oauth2-proxy sidecar, so the gateway stays auth-agnostic. Sun, 28 Dec 2025 23:00:00 GMT K8s ServicesKubernetesMulti-tenancy https://franroa.github.io/platform-engineer/writing.html#read=landscape-helm https://franroa.github.io/platform-engineer/writing.html#read=landscape-helm One chart library consumed everywhere — and deliberately NO controller in the cluster: charts are OCI artifacts Argo CD renders server-side. Mon, 29 Dec 2025 23:00:00 GMT K8s ServicesKubernetesReuse