Understanding on Tom Meurs

NIS2 for Platform Teams: Which Control Satisfies Which Article

Sun, 20 Sep 2026 21:00:00 +0200

TL;DR The Cyberbeveiligingswet has applied since 15 August 2026. Below, the ten measures of article 21 mapped onto controls that actually run, a Kyverno policy that proves one of them, the reporting deadlines as three Prometheus alerting rules, and the four duties no YAML covers. The first run of that policy found seven pods in my own cluster I’d have sworn were mirrored.

Chaos Engineering: Breaking Your Cluster to Make It Stronger

Tue, 28 Apr 2026 19:45:00 +0100

TL;DR Chaos engineering is breaking your own cluster on purpose, with the hypothesis written down first and a rollback ready. I run it on the homelab with Litmus: a weekly pod-delete, a monthly node drain, a game day every quarter. So far it has found four things the dashboard would never have shown me.

My dashboard is a wall of green. Pods running, replicas matched, CPU comfortable, no alerts firing. I look at it and get that small hit of “everything’s fine.” And mostly it is. The cluster’s been up for weeks and nothing has fallen over.

Quantum-safe GPG identity with multiple aliases

Sat, 18 Apr 2026 10:47:00 +0200

TL;DR One GPG masterkey that only certifies, kept offline. Three aliases bound to it, so anyone can check they’re the same person. Ed25519 subkeys for signing and SSH, an ML-KEM plus X448 subkey for encryption so recorded ciphertext stays closed after a quantum computer shows up, and three backups that each assume the other two are gone. Needs GnuPG 2.5.

A cryptographic signature still means exactly what it says. If the key is yours and the signature verifies, the content came from you. No vendor handed you that identity, no CA can pull it, no platform can suspend it. It exists because you generated the key, and it’s yours for as long as you hold the private half. Most of what gets called “online identity” is borrowed. A handle someone can ban, an email address the domain owner can take back the day they feel like it. A GPG signature sits outside all of that.

Distributed Tracing with Tempo and OpenTelemetry

Sat, 04 Apr 2026 19:47:00 +0100

TL;DR Tempo is where my traces go. The OpenTelemetry Collector receives spans from every service, tail sampling keeps every error and every slow request, and Tempo writes the rest to MinIO with three days of retention. From a span in Grafana I click through to the Loki lines with the same trace ID. My production values are at the bottom.

Your metrics say something is slow. Your logs say errors happened. Fine. Which request failed, where did the latency come from, and which service in the chain ate the timeout? Neither of them can tell you.

Simulation, Emulation, Virtualization, and Containers: The Restaurant Metaphor

Mon, 23 Feb 2026 20:18:00 +0100

TL;DR Simulation models a thing without running it. Emulation runs it by rebuilding the hardware in software. Virtualization runs several complete operating systems on one machine. Containers run several apps on one kernel. Below, one restaurant per term, a table, and the four mix-ups I hear most.

“So what’s the difference between a container and a virtual machine?”

I get this question a lot, usually from someone smart who’s been nodding along in meetings and doesn’t quite want to admit they’re fuzzy on it. The honest answer is that most explanations make it worse. They open with “hypervisor”, “kernel sharing” and “hardware abstraction”, and now the person has four new terms to be confused about instead of one.

Zero Trust Explained: The Hotel Key Card Metaphor

Thu, 19 Feb 2026 21:34:00 +0100

TL;DR The old model is a castle. Get past the wall and you’re trusted everywhere inside. Zero trust is a hotel. Your key card opens your room, the gym if you booked it, and nothing else, and every door checks the card every time. Below, the three principles, a day in that hotel, and what the key card turns into once the doors are software.

“So what is this zero trust thing everyone keeps talking about?”

Prometheus and Thanos: Metrics at Scale

Sun, 31 Aug 2025 10:00:00 +0200

TL;DR Prometheus on its own keeps a couple of weeks of metrics on local disk and can’t answer a question across clusters. Thanos puts a sidecar next to each Prometheus, ships the blocks to object storage, and puts a querier in front that reads all of it back through the same PromQL. Below is the install, the four components, the HA and multi-cluster wiring, and the numbers I run in production.

Runtime Security with Falco: Detect Suspicious Behavior in Your Cluster

Thu, 07 Aug 2025 10:00:00 +0200

TL;DR Trivy and Kyverno check an image before it runs. Falco watches what the container does after that, syscall by syscall, and alerts when the behaviour doesn’t match a rule. This post goes from the one thing Falco does to the config I run, with the noise problem in between.

I scanned my images with Trivy. I enforced policies with Kyverno. My workloads got cryptographic identity through SPIFFE. Three layers of prevention, all green, and for a while that felt like enough.

SPIFFE and SPIRE: Zero Trust Service Identity

Sat, 26 Jul 2025 10:00:00 +0200

How does Service A know that Service B is actually Service B?

I keep coming back to that question because the usual answer is uncomfortable. For years we trusted network location. Traffic from the right IP was legitimate, end of story. Zero trust took that assumption out back and shot it. Now every service has to prove who it is, every single request, no matter where it sits on the network.

How etcd Actually Works: The Heart of Your Kubernetes Cluster

Mon, 27 Jan 2025 21:47:00 +0100

When something goes wrong in Kubernetes, the trail usually leads back to etcd. API server timing out? Check etcd. Pods stuck in pending? Might be etcd. Cluster feels sluggish? Probably etcd.

For a long time I treated etcd the way most operators do: as a black box that hums along next to the control plane. “The database.” You back it up and otherwise leave it alone. But black boxes feel like splinters to me, and the first time an etcd cluster fell over at 2am I realised I had no idea what I was actually looking at. So I learned. And it turns out the whole thing is built on a handful of ideas that, once they click, make most etcd problems diagnosable instead of terrifying.