Pushgateway Heartbeat Gotcha: When ndots and NetworkPolicy Silently Eat Your Alerts
How ndots:5, a wildcard DNS record, and a default-deny NetworkPolicy combine to swallow CronJob heartbeats without a single error or alert.
#network-policies
4 posts
ForwardAuth with Authentik: Wiring SSO Across Multiple Apps Without Breaking Ingress
Authentik ForwardAuth on Traefik fails in ways that look like success. Outpost bindings, NetworkPolicies, secret shape, and header mapping across apps.
The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory
Storing agent memory is easy. Deciding what earns a permanent write, and keeping the write-path alive through RBAC and network policy, is the real work.
Network Policies with Calico: Default Deny and Namespace Isolation
Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.