A walkthrough of deploying a three-node PostgreSQL cluster on Kubernetes with OpenEverest v2 and the Percona provider, then chaos-testing failover by killing the primary pod and its volume. Originally published on the OpenEverest blog.

Four attack paths out of one compromised container, proved in a local k3d cluster, closed one control at a time — then what each attack looks like in the API audit log, with two detections written against it.

A field report from inside a project where AI agents did nearly all the work, and the specific ways the codebase came apart while every test stayed green.

Go · vulnerability scanning + LLM-driven remediation

Scans Go repositories for vulnerabilities (Semgrep, Gitleaks, Trivy, plus a built-in pattern matcher), uses an LLM to triage findings in context, and opens a PR with a generated fix — for teams who want vulnerabilities remediated, not just listed. Early-stage and opinionated; a human still reviews and merges every PR.

Go · Kubernetes controller · short-lived credentials

A Kubernetes controller that replaces long-lived Secrets with short-lived, scope-limited credentials minted on demand — one CRD, a reconciler that mints, rotates, revokes, and cleans up on delete, and a provider interface with one real implementation shipped (GitHub App installation tokens; AWS STS, database credentials, and Vault are specified against the same interface but deliberately not built yet). A portfolio project with an honest threat model, not a pitch to replace Vault.

Kubernetes · k3d · attack, fix, detect

A local k3d lab that proves four attack paths out of one compromised container — root, a mounted token that reads every secret, lateral movement, open egress — then closes each with a specific control and re-runs the attack to show the difference. Ends with API audit logging turned on and two written detections (exec into a pod, secret enumeration from a ServiceAccount), so the same moves are alertable when a fix fails.

OpenEverest

so picking a supported model doesn't mean hand-writing an InstancePreset spec

OpenEverest

instances outside the default namespace were silently never reconciled

KubeStellar

catches regressions in what users actually install, not just source builds

Open Cluster Management

lets clusters meet stricter TLS compliance requirements

kro

unblocks conditional resource composition other proposals were waiting on