Security on Landry Zetam - Tech Blog

Lint Your Network Before It Exists: IaC Policy Scanning for VPCs

Tue, 02 Jun 2026 00:00:00 +0000

Most network security failures aren’t exotic. They’re a security group left open to the whole internet on port 22, a subnet that auto-assigns public IPs to everything you launch into it, or a virtual network with flow logs never turned on so you have no record of what happened. The surprise isn’t that these slip through — it’s that you can catch every one of them before a single resource exists, by linting the infrastructure code the same way you lint application code.

Building a Production-Grade Home Network with UniFi VLANs

Tue, 23 Dec 2025 00:00:00 +0000

Your home network doesn’t have to be a flat, insecure mess where your smart toaster can talk to your NAS. With UniFi gear and some intentional design, you can build network segmentation that rivals enterprise setups—without the enterprise price tag. This is how I architected a 10-VLAN home network that isolates everything from security cameras to a 7-node Kubernetes cluster.

Part 1: The Design Philosophy

Why Segment at All?

Most home networks run everything on a single subnet. Your laptop, your Ring cameras, your kids’ tablets, and your IoT light bulbs all share the same network space. This creates several problems:

Complete Kubernetes Security Pipeline - Kube-bench and Kubescape to Obsidian

Fri, 19 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could write comprehensive security reports directly into your second brain every night? Not just one perspective, but two complementary views: infrastructure security and workload security. I built exactly that—a pipeline combining kube-bench (CIS benchmarks) and kubescape (NSA/MITRE frameworks) that publishes human-readable reports to Obsidian automatically. Here’s how the complete system works.

Part 1: Why You Need Both Tools

The Security Visibility Gap

Running a Kubernetes homelab means wearing many hats. Security scanning tools exist, but most people either:

Building a Kubernetes Security Reporter for Obsidian

Wed, 17 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could automatically write security reports directly into your second brain? Today I built exactly that—a system that runs CIS benchmark scans against my K3s cluster and publishes the results as beautifully formatted Obsidian notes. No more checking dashboards or parsing JSON files; just open your vault and see your cluster’s security posture.

Part 1: The Problem

Security Visibility in a Homelab

Running a Kubernetes homelab means wearing many hats: developer, operator, and security engineer. Tools like kube-bench exist to scan your cluster against CIS benchmarks, but they typically output JSON or text that sits in a PersistentVolume gathering dust.

Enabling DNS-01 TLS for Internal Kubernetes Services

Tue, 16 Dec 2025 00:00:00 +0000

Ever visited a website and seen that little padlock icon in your browser? That’s TLS at work, encrypting the connection between you and the server. But what happens when you want that same security for services running on your home network that aren’t accessible from the internet? Today I solved this exact problem, and I want to walk you through not just how I did it, but why each piece matters.

Securing GitOps: SOPS Secret Management in k8s with FluxCD

Thu, 07 Aug 2025 00:00:00 +0000

The Problem: Secrets in GitOps

When I started my Kubernetes homelab journey, I quickly hit a wall that every GitOps practitioner faces: How do you store secrets in Git without compromising security?

The GitOps philosophy is beautifully simple - everything should be in Git. Your entire cluster state, all your applications, configurations, and yes, even secrets. But committing passwords, API keys, and certificates to a public (or even private) repository feels fundamentally wrong. It is wrong.