https://blog.landryzetam.net/categories/observability/Recent content in Observability on Landry Zetam - Tech BlogHugo -- gohugo.ioen-usFri, 19 Dec 2025 00:00:00 +0000https://blog.landryzetam.net/posts/kubernetes-security-pipeline-kubebench-kubescape/Fri, 19 Dec 2025 00:00:00 +0000https://blog.landryzetam.net/posts/kubernetes-security-pipeline-kubebench-kubescape/<p>What if your Kubernetes cluster could write comprehensive security reports directly into your second brain every night? Not just one perspective, but two complementary views: infrastructure security <em>and</em> workload security. I built exactly that—a pipeline combining kube-bench (CIS benchmarks) and kubescape (NSA/MITRE frameworks) that publishes human-readable reports to Obsidian automatically. Here&rsquo;s how the complete system works.</p> <hr> <h2 id="part-1-why-you-need-both-tools">Part 1: Why You Need Both Tools</h2> <h3 id="the-security-visibility-gap">The Security Visibility Gap</h3> <p>Running a Kubernetes homelab means wearing many hats. Security scanning tools exist, but most people either:</p>https://blog.landryzetam.net/posts/prometheus-wal-replay/Thu, 18 Dec 2025 00:00:00 +0000https://blog.landryzetam.net/posts/prometheus-wal-replay/<p>There&rsquo;s a special kind of frustration that comes from watching a pod restart 90 times over 37 hours, each time getting <em>just</em> a little further before Kubernetes kills it again. Today I debugged a Prometheus instance stuck in an infinite crash loop, and the root cause was surprisingly subtle: the database was simply too large to start within the default health check window.</p> <p>This is the story of startup probes, Write-Ahead Logs, and why your monitoring system might be the hardest thing to monitor.</p>https://blog.landryzetam.net/posts/kubernetes-security-reporter-obsidian/Wed, 17 Dec 2025 00:00:00 +0000https://blog.landryzetam.net/posts/kubernetes-security-reporter-obsidian/<p>What if your Kubernetes cluster could automatically write security reports directly into your second brain? Today I built exactly that—a system that runs CIS benchmark scans against my K3s cluster and publishes the results as beautifully formatted Obsidian notes. No more checking dashboards or parsing JSON files; just open your vault and see your cluster&rsquo;s security posture.</p> <hr> <h2 id="part-1-the-problem">Part 1: The Problem</h2> <h3 id="security-visibility-in-a-homelab">Security Visibility in a Homelab</h3> <p>Running a Kubernetes homelab means wearing many hats: developer, operator, and security engineer. Tools like <a href="https://github.com/aquasecurity/kube-bench">kube-bench</a> exist to scan your cluster against CIS benchmarks, but they typically output JSON or text that sits in a PersistentVolume gathering dust.</p>