Shadow AI in CI/CD: Threat-modeling the path from developer laptop to Kubernetes
Artificial intelligence is becoming part of daily software delivery, often before it becomes part of the security architecture. That gap has a name: Shadow AI. It is any AI tool, model, agent, extension, or integration used…
Multi-Cluster databases on Kubernetes: Architecture and deployment
Introduction Running a database on Kubernetes is well understood. Running one that survives a complete regional failure, a corrupted control plane, or a severed network requires a fault-resistant architecture. This post walks through how to build…
Impact Since completing the migration, Michelin has experienced no CNI-related failures or incidents across its fleet. For a platform team that previously spent significant time firefighting networking problems that they couldn’t even observe clearly, this has…
Securing CI/CD for an open source project, part 3: Credentials, verification, and what’s next
This is the third and final post in a series on how Cilium hardens its CI/CD pipeline. Part 1 covered access control and Part 2 covered dependency hardening. This post covers the last layer: keeping CI…
In March, I gave a talk at KubeCon + CloudNativeCon Europe 2026 in Amsterdam. After the session, the same questions kept coming up on the CNCF Slack and in person: why build agentic AI on cloud…
From data residency to digital sovereignty: Architectural patterns for cloud native platforms
Over the past two years, digital sovereignty has evolved from a policy discussion into a practical platform engineering concern. The EU Data Act has been fully applicable since January 11, 2025. NIS-2 and DORA already shape…
Securing CI/CD for an open source project: Locking down dependencies
Part two This is the second post in a three-part series on how Cilium hardens its CI/CD pipeline. Part 1 covered access control: who can trigger builds and what code CI is allowed to execute. This…
Breaking the single datacenter assumption Modern AI architectures are built on the assumption of centralized, homogeneous data centers. In reality, infrastructure is messy. For most organizations, compute resources are fragmented across private clouds, research environments, and…