DevOps engineer working on bare-metal Kubernetes, SLSA L3 signed supply chains, GitOps with Argo CD, and AWS delivery with centralised secrets and logging.https://kythuat.vnenhttps://kythuat.vn/blog/security-that-matches-your-traffichttps://kythuat.vn/blog/security-that-matches-your-trafficTutorials put WAF, Origin Shield and Shield Advanced in front of sites that get four thousand visits a month. This works out, with verified August 2026 prices, the traffic level at which each layer starts paying for itself — and shows that for a portfolio the honest answer is a hosted zone and nothing else.Sun, 23 Aug 2026 00:00:00 GMTawscloudfronts3costsecurityhttps://kythuat.vn/blog/the-interview-question-about-ssh-keyshttps://kythuat.vn/blog/the-interview-question-about-ssh-keys"You have a lot of hosts — how do you manage SSH keys?" is really a question about where authorisation state lives. Working the answer from authorized_keys through Vault SSH certificates to Session Manager, and admitting which layer actually solves the problem.Sun, 09 Aug 2026 00:00:00 GMTsshvaultawssecurityoperationshttps://kythuat.vn/blog/it-is-probably-not-dnshttps://kythuat.vn/blog/it-is-probably-not-dns"It's always DNS" is a punchline that became a diagnostic strategy. Six unrelated faults — ephemeral ports, conntrack, MTU, egress policy, CPU throttling, kube-proxy rule scaling — produce a symptom indistinguishable from a DNS failure, and each has one observation that rules it out.Sun, 26 Jul 2026 00:00:00 GMTkubernetesnetworkingdnsdebuggingobservabilityhttps://kythuat.vn/blog/your-allowlist-is-where-the-misses-come-fromhttps://kythuat.vn/blog/your-allowlist-is-where-the-misses-come-fromAuditing three of my own repositories for credentials before publishing them. The regex found the easy half; the exclusions I added to quiet the noise are what hid the rest.Sun, 12 Jul 2026 00:00:00 GMTsecuritysecretsauditgitmethodologyhttps://kythuat.vn/blog/security-scanning-on-gitlab-cehttps://kythuat.vn/blog/security-scanning-on-gitlab-ceThe built-in scanning templates are an Ultimate feature. Building the same coverage from Trivy, Gitleaks and Semgrep — and finding the one security-shaped report a Community Edition merge request will actually render.Sun, 28 Jun 2026 00:00:00 GMTgitlabci-cdtrivysemgrepsecurityhttps://kythuat.vn/blog/a-secret-in-a-gitops-repo-is-a-secret-in-productionhttps://kythuat.vn/blog/a-secret-in-a-gitops-repo-is-a-secret-in-productionPulling hardcoded credentials out of Argo CD-synced manifests, and finding the connection string that made the whole exercise pointless — plus why a working default credential is worse than no default at all.Sun, 14 Jun 2026 00:00:00 GMTkubernetesgitopsargo-cdsecretssecurityhttps://kythuat.vn/blog/the-csp-and-the-build-did-not-agreehttps://kythuat.vn/blog/the-csp-and-the-build-did-not-agreeA postmortem on a bug that could not fail locally — the security header lived in one repository layer and the markup that violated it in another, and only production applied both.Sun, 24 May 2026 00:00:00 GMTpostmortemcspastroterraformcloudfronthttps://kythuat.vn/blog/private-s3-origin-with-cloudfront-oachttps://kythuat.vn/blog/private-s3-origin-with-cloudfront-oacOrigin Access Control, a CloudFront Function for clean URLs, and why a private origin returns 403 instead of 404.Sun, 03 May 2026 00:00:00 GMTawscloudfronts3terraformhttps://kythuat.vn/blog/signing-images-is-the-easy-halfhttps://kythuat.vn/blog/signing-images-is-the-easy-halfCosign takes an afternoon. Making the cluster refuse an unsigned image is where supply-chain work actually starts.Sun, 12 Apr 2026 00:00:00 GMTsupply-chainkuberneteskyvernocosignslsahttps://kythuat.vn/blog/i-built-a-sketch-and-the-hash-map-wonhttps://kythuat.vn/blog/i-built-a-sketch-and-the-hash-map-wonA streaming algorithm with a beautiful error bound, benchmarked against the boring alternative on the workload it was actually for — and what the two benchmarks disagreeing taught me about reading my own numbers.Sun, 22 Mar 2026 00:00:00 GMTalgorithmsstreamingbenchmarkscppdetectionhttps://kythuat.vn/blog/the-kernel-knows-everything-except-who-you-arehttps://kythuat.vn/blog/the-kernel-knows-everything-except-who-you-areBuilding an eBPF collector that catches every outgoing TCP connection from a pod — and discovering that the hard part is not the kprobe, it is turning a cgroup id back into a pod name without asking the API server.Sun, 08 Mar 2026 00:00:00 GMTebpfkubernetesco-relibbpfobservability