Blog
Write-ups and notes on things I build and break.
Posts
-
SAGE: CVE-driven patching for Kubernetes nodes, one node at a time
A patch management system for Kubernetes nodes: it checks whether each CVE really applies to each node, lets a policy decide, and patches one node at a time with a canary and rollback. The LLM only reads public CVE data, on a local CPU-only model.
-
Fire TV Stick slowing down your whole Wi-Fi? The mDNS flood fix
A known, unfixed Fire OS bug floods the network with ~300 mDNS packets/second whenever a Fire TV is on it. Two 2-minute fixes that don't need rooting, the root cause, and a permanent fix on the device itself.
-
Getting a fix into net.git: mv88e6xxx and the missing PTP
A switch that wouldn't probe, traced to a driver assuming PTP hardware two Marvell switch models don't have — and the review process that turned it into a merged net.git commit.
-
Let's build a k8s cluster with Ansible
A file-by-file walkthrough of the Ansible project behind a 5-node HA Kubernetes cluster on Proxmox: load balancer, kubeadm bootstrap, Longhorn storage, MetalLB, and a resilience test.
-
Two computers, one firewall: OpenWrt on the Sophos XGS 107w
Replacing Sophos's firmware with OpenWrt on both computers inside an XGS 87/107 desktop firewall, and building an Ethernet link between them over a PCIe endpoint with no Sophos code.
-
Reverse engineering the Cavium CN6640 BAR2 datapath
How I turned an OCTEON II SNIC10E card with no public documentation and no vendor firmware into two working 10GbE interfaces under mainline Linux.