https://unresolved.dev Writing about infrastructure, security, and the engineering assumptions underneath the systems we build. en https://unresolved.dev/articles/multi-layered-hardening-for-kubernetes https://unresolved.dev/articles/multi-layered-hardening-for-kubernetes Thu, 17 Sep 2026 00:00:00 GMT A hardened Kubernetes cluster is not the sum of six checklists completed once. It is six layers that each need to be tested on their own terms, because none of them defends the others. Kubernetes Security https://unresolved.dev/articles/observability-isnt-the-same-thing-as-logging https://unresolved.dev/articles/observability-isnt-the-same-thing-as-logging Tue, 08 Sep 2026 00:00:00 GMT Logging tells you what a system said about itself. Observability is being able to ask a question you didn't anticipate and still get an answer. Observability https://unresolved.dev/articles/the-security-control-that-worked-too-well https://unresolved.dev/articles/the-security-control-that-worked-too-well Mon, 24 Aug 2026 00:00:00 GMT Effectiveness and accountability are not the same property. A control can have both, or either, or neither, and the failure mode of 'either' is easy to miss. Kubernetes Security https://unresolved.dev/articles/cloud-firewall-logs-everything-except-what-it-drops https://unresolved.dev/articles/cloud-firewall-logs-everything-except-what-it-drops Tue, 11 Aug 2026 00:00:00 GMT Closing out ten months of testing Alibaba Cloud with the same question the series opened on: a control that stops something is not automatically a control that tells you about it. Cloud Security https://unresolved.dev/articles/when-prevention-isnt-detection https://unresolved.dev/articles/when-prevention-isnt-detection Mon, 20 Jul 2026 00:00:00 GMT Most security stacks conflate 'we stopped it' with 'we understood it.' The gap between those two claims is where the expensive incidents live. Cloud Security https://unresolved.dev/articles/elastic-gpu-service-and-the-myth-of-elastic https://unresolved.dev/articles/elastic-gpu-service-and-the-myth-of-elastic Tue, 14 Jul 2026 00:00:00 GMT Elasticity is a claim about behavior under contention, not behavior under normal conditions. Most of us only ever test the second one. AI Infrastructure https://unresolved.dev/articles/the-castle-was-never-the-problem https://unresolved.dev/articles/the-castle-was-never-the-problem Mon, 22 Jun 2026 00:00:00 GMT The castle-and-moat model isn't wrong because perimeters are useless. It's wrong because it teaches you to stop asking questions the moment something is denied entry. Security https://unresolved.dev/articles/i-gave-an-ai-agent-real-cloud-credentials https://unresolved.dev/articles/i-gave-an-ai-agent-real-cloud-credentials Tue, 09 Jun 2026 00:00:00 GMT Agentic AI tools are increasingly given direct cloud access to get things done. The interesting risk isn't that they'll refuse the task. It's what they'll do in service of completing it. AI Security https://unresolved.dev/articles/i-thought-security-meant-blocking-the-attack https://unresolved.dev/articles/i-thought-security-meant-blocking-the-attack Mon, 01 Jun 2026 00:00:00 GMT The first thing I had to unlearn about infrastructure security wasn't a technique. It was what 'working' meant. Security https://unresolved.dev/articles/anti-ddos-basic-is-a-default-not-a-defense https://unresolved.dev/articles/anti-ddos-basic-is-a-default-not-a-defense Wed, 06 May 2026 00:00:00 GMT Free, built-in DDoS protection sounds like a solved problem until you find the specific number where it stops being free protection and starts being a decision you need to make. Infrastructure https://unresolved.dev/articles/an-oss-bucket-set-to-private https://unresolved.dev/articles/an-oss-bucket-set-to-private Wed, 08 Apr 2026 00:00:00 GMT Public bucket exposure is one of the oldest cloud misconfiguration classes there is. Testing it directly on OSS showed exactly how a bucket set to private can still leak individual objects. Cloud Security https://unresolved.dev/articles/an-ack-cluster-is-not-the-cluster-you-think-it-is https://unresolved.dev/articles/an-ack-cluster-is-not-the-cluster-you-think-it-is Tue, 10 Mar 2026 00:00:00 GMT Moving to Alibaba Cloud's managed Kubernetes service removed a real category of operational burden. It removed none of the security decisions that actually determine whether a cluster is safe. Infrastructure https://unresolved.dev/articles/the-model-you-deployed-on-pai https://unresolved.dev/articles/the-model-you-deployed-on-pai Wed, 11 Feb 2026 00:00:00 GMT It's comforting to think of deployment as a copy operation. Testing that assumption on Alibaba Cloud's PAI platform turned up a measurable gap between training-time and serving-time behavior. AI Infrastructure https://unresolved.dev/articles/a-security-group-is-not-a-firewall https://unresolved.dev/articles/a-security-group-is-not-a-firewall Wed, 14 Jan 2026 00:00:00 GMT It's tempting to treat an ECS security group as 'the firewall' for a workload. That framing quietly drops the parts of the traffic path a security group was never designed to see. Cloud Security https://unresolved.dev/articles/what-actiontrail-actually-records https://unresolved.dev/articles/what-actiontrail-actually-records Wed, 10 Dec 2025 00:00:00 GMT Turning on ActionTrail feels like turning on visibility. It's closer to turning on one particular kind of visibility, with real gaps that only show up when you go looking for them. Observability https://unresolved.dev/articles/ram-policies-look-like-rbac https://unresolved.dev/articles/ram-policies-look-like-rbac Wed, 12 Nov 2025 00:00:00 GMT RAM and RBAC both use roles and policies. That surface similarity hides a structural difference that changes how a permission mistake actually plays out. Cloud Security