Systems, rendered as systems

Defence in depth on a GKE estate: every layer assumes the one in front of it has already been breached. Nothing here trusts the network.

13 components · 12 flows

Stages fan out in parallel per pull request instead of running serially per repo. Advisory mode reports without blocking until a team opts in.

9 components · 11 flows

istiod issues short-lived certificates; PeerAuthentication enforces STRICT on the server, DestinationRule sends mTLS from the client. A sidecar-less caller is refused — that's the feature.

6 components · 4 flows

A recurring incident with a known fix gets wired to the signal instead of to a human. Roughly 80% resolve before anyone is paged.

6 components · 6 flows

Developers click a template; the portal produces a pull request. Nothing reaches an environment without peer review and an audit trail.

8 components · 7 flows