Shifting validation to review-time changes developer behavior in several practical ways. Faster feedback. Rather than waiting for a CI run to complete, violations appear immediately during review. Issues can be addressed before merge, in the same context where they were introduced. Shared visibility. Policy violations are no longer buried in CI logs accessible only to the developer. They become part of the review discussion, visible to the entire team. This builds shared awareness of policy intent—not just individual compliance. Fewer feedback loops. In early usage across real pull requests, a
Why Kubernetes policy enforcement happens too late—and what to do about it…It runs on Cilium’s eBPF-powered datapath, which provides excellent performance, deep visibility, and seamless integration with Cilium Network Policies. Why Teams Choose This Path Minimal changes to application manifests and…
…unless a policy explicitly opts in. The learning curve was still real. kgateway sits at the intersection of Kubernetes, Envoy Proxy, and the Gateway API, so even small changes often required understanding…
…As Andy described it: “It kind of sits between the management platform and the collector. It speaks to the collector on behalf of the management platform, and it can accept changes.” The…
…Who defines policy? Open Policy Agent (OPA) puts fine-grained authorization and governance decisions into policy you own and version, enforced consistently across the stack, so the rules travel with your code…
…What changes is who the platform serves, what it must do, and how it must be built. That evolution is organized around five pillars: AI-Native Platform — The platform supports AI workloads…
…production deployment, privilege escalation, data export, deletion, network-policy changes. In a GitOps model, the pull request is the approval gate: the agent proposes a manifest change, a human approves the merge…
…and configuration change. What was deployed, when, and what was different from yesterday? Infrastructure state: The actual, current shape of cloud accounts, networks, Kubernetes clusters, queues, databases, and IAM policies. What does…
…As our platform scaled to 50+ clusters, each spinning up dozens of services and ingress endpoints, that provisioning lag became a genuine operational bottleneck, and the paper trail for DNS changes lived…
…GetQueueAttributes GetQueueUrl ReceiveMessage DeleteMessage ChangeMessageVisibility Example IAM policy: { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsumeFromQueue", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility" ], "Resource": "arn:aws:sqs…
…The Roots of the Platform This mgmt cluster is where everything starts. It was bootstrapped with OpenTofu with three control plane nodes, K3s HA, Cilium CNI, all provisioned as code before a…
