Build
The Lab
Experiments, tests, and practical investigations behind the ideas. Writing about how a system should behave is one thing. Testing how it actually behaves is another.
Completed
Aug 2026When a validating admission webhook blocks a request, does the cluster retain enough evidence to reconstruct what was attempted, by whom, and how many times?
A denied admission request generates a Kubernetes API audit event, so I expected the default audit configuration to give us everything we'd need for a post-incident timeline without any extra instrumentation.
KubernetesSecurityObservability
Explore experimentCompleted
Jun 2026If a NetworkPolicy's podSelector is subtly wrong, matching more or fewer pods than intended, how much east-west traffic actually gets exposed, and would anything alert on it?
I expected an empty or overly broad selector to be functionally equivalent to having no policy at all, and I expected some signal (a metric, a warning, anything) when a policy matched zero pods.
KubernetesNetworkingSecurity
Explore experiment