$ ls blog/
Blog
Notes on platform work — written up while the details are still fresh, mostly so I stop re-deriving them.
RSS: https://kythuat.vn/rss.xml paste into a feed reader — opening it in a browser just shows raw XML
2026
11 posts- 23 Aug 2026
Security that matches your traffic
Tutorials put WAF, Origin Shield and Shield Advanced in front of sites that get four thousand visits a month. This works out, with verified August 2026 prices, the traffic level at which each layer starts paying for itself — and shows that for a portfolio the honest answer is a hosted zone and nothing else.
- 09 Aug 2026
The interview question about SSH keys
"You have a lot of hosts — how do you manage SSH keys?" is really a question about where authorisation state lives. Working the answer from authorized_keys through Vault SSH certificates to Session Manager, and admitting which layer actually solves the problem.
- 26 Jul 2026
It is probably not DNS
"It's always DNS" is a punchline that became a diagnostic strategy. Six unrelated faults — ephemeral ports, conntrack, MTU, egress policy, CPU throttling, kube-proxy rule scaling — produce a symptom indistinguishable from a DNS failure, and each has one observation that rules it out.
- 12 Jul 2026
Your allowlist is where the misses come from
Auditing three of my own repositories for credentials before publishing them. The regex found the easy half; the exclusions I added to quiet the noise are what hid the rest.
- 28 Jun 2026
Security scanning on GitLab CE, where none of the security features exist
The built-in scanning templates are an Ultimate feature. Building the same coverage from Trivy, Gitleaks and Semgrep — and finding the one security-shaped report a Community Edition merge request will actually render.
- 14 Jun 2026
A Secret in a GitOps repo is a Secret in production
Pulling hardcoded credentials out of Argo CD-synced manifests, and finding the connection string that made the whole exercise pointless — plus why a working default credential is worse than no default at all.
- 24 May 2026
The CSP was in Terraform, the script was in Astro, and nothing checked
A postmortem on a bug that could not fail locally — the security header lived in one repository layer and the markup that violated it in another, and only production applied both.
- 03 May 2026
Serving a static site from S3 without making the bucket public
Origin Access Control, a CloudFront Function for clean URLs, and why a private origin returns 403 instead of 404.
- 12 Apr 2026
Signing container images is the easy half
Cosign takes an afternoon. Making the cluster refuse an unsigned image is where supply-chain work actually starts.
- 22 Mar 2026
I built a Count-Min Sketch and the hash map won
A streaming algorithm with a beautiful error bound, benchmarked against the boring alternative on the workload it was actually for — and what the two benchmarks disagreeing taught me about reading my own numbers.
- 08 Mar 2026
The kernel knows everything except who you are
Building an eBPF collector that catches every outgoing TCP connection from a pod — and discovering that the hard part is not the kprobe, it is turning a cgroup id back into a pod name without asking the API server.