[{"content":"[DRAFT] Busy reworking the demo. Recently I migrated the K3S instances from DigitalOcean to Vultr and Hivelocity. The draw was Vultr\u0026rsquo;s generous egress bandwidth allowance and Hivelocity\u0026rsquo;s inexpensive dedicated instances on older hardware.\nI\u0026rsquo;m posting the draft as a non-draft to test the new website layout and behavior across devices and viewport sizes.\nFenced code block syntax highlighting test # Comment function ls_lh { base_dir=\u0026#34;${1:-.}\u0026#34; for idx in $(seq 1); do ls -lh \u0026#34;${base_dir}\u0026#34; | cat done } echo \u0026#34;scale=512; 4*a(1);\u0026#34; | bc -l","date":"2023-12-24","description":"Demo of onyx.bstk.co running K3S.","section":"posts","title":"Single-node K8S","url":"/posts/demo-onyx-bstk-co/"},{"content":"Core Infra is a multi-account AWS estate built to the standard of a small company\u0026rsquo;s production, and used for the opposite purpose: as a place to run things that are too risky, too noisy or too experimental for a real production environment. Network experiments, security exercises, data projects, new delivery pipelines and identity models all run here on infrastructure that already has the readiness a business would need, so an experiment starts from a working foundation rather than from zero.\nWhat\u0026rsquo;s deployed Four AWS accounts under one organization: management, security, development and production, with Identity Center SSO and per-role profiles. Root login is break-glass only. A security account as delegated admin for GuardDuty and IAM Access Analyzer, alerting through SNS. Budget alarms are set per account and verified to fire. A management VPC running the VPN (WireGuard and OpenVPN with its own PKI) and DNS resolvers with DNS-over-TLS, DNSSEC validation and RPZ blocklists. A services VPC for small things with real users: a URL shortener behind Auth0, a DNS leak-test service, an IPv4/IPv6 what-is-my-IP endpoint, a self-hosted CI runner, and on-demand Vault, Kali and observability instances. Four EKS clusters that form a maturity ladder, each adding one layer: no mesh, then Linkerd, then Istio Ambient, then Cilium with eBPF datapath, Hubble and Istio Ambient. Each is scored on dated proof, and rebuilt from nothing to verify it. They run when needed and are torn down for cost in between. What runs here Traffic routing and progressive delivery with Flux, Flagger and Argo CD; network policy, mTLS and isolation controls observed through Hubble and Linkerd; identity for humans, groups and workloads; DNS and VPN experiments; data projects; and security training on real targets.\nWhy it exists Production systems carry obligations that rightly shape what gets built there: existing integrations, compliance, delivery dates, and priorities set by the business. Core Infra has none of those, by design. It was built to close gaps in knowledge and capability by doing things properly, with no timeline and no constraint beyond cost.\nHere, curiosity is reason enough to start a piece of work. An overhaul can be undertaken purely to learn its true scope and depth, then reverted, with the understanding gained as the whole result. Several approaches and toolchains can be tried on the way to a defensible opinion about the right one, and that opinion is free to change as the tooling and the understanding evolve. Nothing here is a product. The repeatable, production-grade foundation is what the exploring leaves behind.\nThe infrastructure code and the applications are private. The posts on this site are the public record of individual experiments.","date":"","description":"","section":"about","title":"About","url":"/about/"},{"content":"Last Updated: 2024-01-10\n1. Introduction This Cookie Policy explains how Core Infra (\u0026ldquo;we,\u0026rdquo; \u0026ldquo;us,\u0026rdquo; or \u0026ldquo;our\u0026rdquo;) uses cookies and similar technologies when you visit our website coreinfra.org (the \u0026ldquo;Website\u0026rdquo;). By using the Website, you consent to the use of cookies as described in this policy.\n2. What Are Cookies? Cookies are small text files that are stored on your device (computer, tablet, smartphone) when you visit a website. They are widely used to make websites work or to work more efficiently, as well as to provide information to the owners of the site.\n3. Types of Cookies We Use We use the following types of cookies on our Website:\nEssential Cookies: These cookies are necessary for the proper functioning of the Website. They enable you to navigate the site and use its features.\nAnalytical/Performance Cookies: These cookies allow us to recognize and count the number of visitors and to see how visitors move around our Website when they are using it. This helps us improve the way our Website works, for example, by ensuring that users find what they are looking for easily.\nFunctionality Cookies: These cookies are used to recognize you when you return to our Website. This enables us to personalize our content for you and remember your preferences.\n4. Your Consent By using our Website, you consent to the use of the cookies described in this policy. If you do not consent to the use of these cookies, please disable them following the instructions provided in this policy or by changing your browser settings.\n5. How to Disable Cookies Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impair your overall user experience.\n6. Changes to This Cookie Policy We may update this Cookie Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this policy periodically.\n7. Contact Us If you have any questions about our use of cookies or this Cookie Policy, please contact us at info@coreinfra.org.","date":"","description":"","section":"about","title":"Cookie Policy","url":"/about/cookies/"},{"content":"placeholder.","date":"","description":"","section":"about","title":"Privacy Policy","url":"/about/privacy/"}]