Posts

2026-08-21 Signing TLS handshakes inside a TPM
A client certificate whose private key stays in the TPM: what crypto/tls asks of a key, the Go for both ends, and what it costs per handshake.
2026-08-21 Migrating out of GDC air-gapped in an emergency
When an air-gapped GDC site is no longer available, its export can't be applied anywhere else. One controller translates those CRDs into Config Connector resources and rebuilds the entire estate in public Google Cloud.
2026-08-20 Blocking VoidLink with Tetragon
How VoidLink stages itself without touching disk, and the Tetragon TracingPolicy that kills each stage.
2026-07-26 A TPM has a clock, but it does not have the time
What tpm2_readclock actually returns on a confidential VM, and why freshness ends up being a nonce.
2026-05-16 cek (Container Exploration Kit)
A small CLI for reading and exploring OCI container images without running them.
2025-07-26 Terraform, Google Cloud, and Secrets
A guide to managing Google Cloud secrets in Terraform safely using ephemeral resources and write-only arguments.
2024-12-22 S3-native state locking
Reflecting on the implementation of S3-native state locking in Terraform, highlighting the challenges, teamwork, and community feedback that made it a success.
2024-12-18 Why there isn't a generic HCL formatter
If you were wondering why there isn't a generic HCL formatter, this post is for you.
2020-06-12 Behind the Scenes Lambda
How does AWS Lambda work under the hood? Let's find out together!