Replace long-lived AWS access keys with short-lived STS credentials from OpenBao that expire on their own, and keep the root key out of reach.

Swap static database passwords for dynamic credentials: users created on request and dropped when the lease ends. How we run it on OpenBao and Vault.

Most teams leaving Vault Enterprise only use features OpenBao and free Vault already have. The hard part is configuration, so we built a tool to migrate it.

Turn one hardened golden image into a fully configured, environment-specific node on first boot with cloud-init, systemd and vals, with no configuration drift.

A practical guide to hardening your software supply chain using Cosign, Kyverno, Harbor, SHA digests, and SBOMs.

A practical engineering guide to future-proofing server access by enabling ML-KEM hybrid post-quantum key exchange in OpenSSH 9.9 and 10.0.

How We Mastered AI-Assisted Development: Planning, Agents, and the Power of CLAUDE.md

Kubernetes CNI-native WireGuard encryption versus a VM-level WireGuard underlay: the technical differences, pros and cons, and how to choose for your cluster.

A blueprint for multi-DC Apache Cassandra across sovereign European infrastructure, using a WireGuard mesh for data autonomy and vendor-neutral security.

Build immutable server images with Packer and Ansible instead of patching live boxes over SSH, for more secure, repeatable infrastructure.

In an era where proprietary licensing can threaten operational stability, OpenBao emerges as a vendor-neutral alternative for secrets management.

Stop managing certificates manually. Learn how to automate Kubernetes SSL/TLS for Ingress and internal services using cert-manager, Vault, and OpenBao.

Discover how OpenBao, the open-source alternative to HashiCorp Vault, delivers secure, community-driven secrets management.

You can't recover a lost Cassandra superuser password, but you can reset it. Why versions differ on authentication and a step-by-step recovery guide.

Enterprise databases keep getting breached through weak encryption, poor access control and misplaced trust in internal systems. Why, and how to fix it.

Our simpler standard for collecting metrics, traces and logs: why we moved away from the legacy model and what a lean observability setup looks like.

Pasting company data into public AI tools carries real risk. What can go wrong with AI and LLMs, and how to protect your organisation's data.

Why log collection is more than a compliance checkbox, and how we collect logs to gain insight into security, performance and reliability.

Back to basics with SSH: using SSH agent for key management, proxying connections through jump hosts, and security best practices.

How a managed services team switches safely between many customer workloads and environments without running commands against the wrong one.

Secure external access to a Strimzi Kafka cluster on Kubernetes using Traefik ingress and your own certificate authority instead of self-signed certificates.

How we secure Kubernetes ingresses with mutual TLS using Traefik TLSOptions, cert-manager and HashiCorp Vault, plus the gotchas we hit.

How we remove static database passwords with HashiCorp Vault dynamic credentials and the vals-operator DbSecret, so access expires within an hour.

Rotate Apache Cassandra SSL certificates often using HashiCorp Vault as the CA and consul-template, reloading SSL without restarting nodes.

Vals-Operator 0.6.2 syncs secrets from external stores into Kubernetes secrets. This release updates core libraries and adds secret templates.

We’re going to look at how to manage network policies in Kubernetes with Calico.

An introduction to Kubernetes Network Policies: how to isolate workloads and control pod-to-pod traffic, with practical examples you can apply.

Introducing vals-operator — an opensource tool for managing secrets in Kubernetes

The built-in ones are good for most use cases. They are pretty granular covering access to Rancher itself down to individual projects or…

This blog shows you how and provides a fully working Ansible project on Github to install Kafka and manage its security.

How Kafka can help meet regulatory standards and compliance when used as an event broker to Security Information and Event Management (SIEM) systems.

A short blog on how to monitor SSL certificate expiry on databases such as Apache Cassandra using Prometheus and visualise on a Grafana dashboard.

Unexpected out-of-memory errors in Kafka Connect over SSL? Configure SSL separately for internal connections, consumers and producers.

This blog outlines some good practices that can help you secure your Apache Cassandra clusters.