DevOps · Cluster
Platform Automation
Self-service and policy as code.
- 01 Level-Triggered Reconciliation and the Desired-State Loop How a platform controller converges observed state toward declared state, why it re-reads everything on every pass, and what that costs in API traffic and correctness.
- 02 What an Admission Webhook Can and Cannot Decide The position of admission control in the write path, the fields a webhook receives, and why cross-object invariants and external state cannot be enforced there.
- 03 Evaluation Semantics of a Policy Query Language Why a policy language evaluates rules as queries over a document, how undefined differs from false, and where the cost of a rule actually goes.
- 04 Template Ownership When Scaffolding a New Service A generator produces a fork of the template the moment it runs. What that implies for update paths, three-way merges, and the split between generated and referenced configuration.
- 05 Saved Plans, State Serial, and Why Apply Must Be Pinned A saved plan is a reviewable artifact tied to one state snapshot. What it records, why apply rejects a stale one, and where the guarantee stops.
- 06 Delegating Provisioning Without Delegating the Account How a self-service pipeline obtains cloud credentials through workload identity federation, what the trust policy must pin, and how the blast radius stays bounded.
- 07 Quota Accounting Lags Admission, and What That Permits Quota is enforced against a recomputed usage figure rather than a reservation. How the check-then-act window opens, what falls into it, and where a second guardrail is needed.
- 08 Sync Ordering and Pruning in a Git-Driven Control Loop A reconciler that applies a directory of manifests has to decide what order to apply in and what to delete. Both decisions have failure modes that a diff never shows.
- 09 Testing Policy Before It Gates the Cluster Unit tests over policy rules, fixtures captured from the position where the policy runs, and the differential check that makes enforcement a measurable step.
- 10 Versioning the Platform Interface Under Existing Tenants How a self-service interface changes without breaking its consumers: explicit versions, compatibility guarantees, and why the parts nobody uses break first.