Notes on DevOps, SRE and Platform Engineering.https://platformnews.net/en-UShttps://platformnews.net/en/blog/ai-agent-identity/https://platformnews.net/en/blog/ai-agent-identity/Workload identity tells you which pod is calling. AI agents need more: on whose behalf they act, and what they may do right now. A practical guide to agent identity with RFC 8693 token exchange, the MCP authorization spec, token vaults, and the managed options on AWS, Google Cloud and Microsoft Entra.Mon, 19 Oct 2026 00:00:00 GMTsecurityai-agentsworkload-identitymcpoauthsecuritymulti-cloudhttps://platformnews.net/en/blog/aks-workload-identity/https://platformnews.net/en/blog/aks-workload-identity/Give every AKS pod its own Azure identity without client secrets: how Entra Workload ID works, step-by-step setup with az CLI and Terraform, Key Vault CSI, scaling past 20 federated credentials, and managing it all from the app's Helm chart with Azure Service Operator.Mon, 19 Oct 2026 00:00:00 GMTsecurityazureaksentra-idworkload-identityasokuberneteshttps://platformnews.net/en/blog/clickhouse-logging-instead-of-elasticsearch/https://platformnews.net/en/blog/clickhouse-logging-instead-of-elasticsearch/A practical blueprint for moving logs from Elasticsearch to ClickHouse: Vector and Kafka for ingestion, an OpenTelemetry-shaped schema with the new text index, TTL-based tiering to S3, multi-region search from one UI, and the gotchas that bite in production.Mon, 19 Oct 2026 00:00:00 GMTobservabilityclickhouseloggingelasticsearchobservabilityvectoropentelemetryhttps://platformnews.net/en/blog/gke-workload-identity/https://platformnews.net/en/blog/gke-workload-identity/A practical guide to Workload Identity Federation for GKE: direct principal access vs linked service accounts, gcloud and Terraform setup, verification, cross-project access, gotchas, and managing it as YAML with Config Connector.Mon, 19 Oct 2026 00:00:00 GMTsecuritygcpgkeworkload-identityiamconfig-connectorkuberneteshttps://platformnews.net/en/blog/iam-roles-anywhere-multi-cloud-hub/https://platformnews.net/en/blog/iam-roles-anywhere-multi-cloud-hub/Give machines with no cloud identity — on-prem VMs, edge devices, self-hosted CI — short-lived X.509 certificates from Vault PKI, turn them into AWS role sessions with IAM Roles Anywhere, and federate onward to Google Cloud and Azure without a single static key.Mon, 19 Oct 2026 00:00:00 GMTsecurityawsiam-roles-anywherepkivaultworkload-identitymulti-cloudhttps://platformnews.net/en/blog/workload-identity-federation-aws-to-azure/https://platformnews.net/en/blog/workload-identity-federation-aws-to-azure/Let EC2, Lambda, ECS and EKS workloads call Azure with short-lived tokens: AWS IAM outbound identity federation, Entra federated credentials on managed identities, the EKS shortcut, and a hub-and-spoke design.Mon, 19 Oct 2026 00:00:00 GMTsecurityazureawsentra-idworkload-identityiammulti-cloudhttps://platformnews.net/en/blog/workload-identity-federation-aws-to-gcp/https://platformnews.net/en/blog/workload-identity-federation-aws-to-gcp/Let EC2, Lambda, ECS and EKS workloads call Google Cloud with short-lived tokens: how the token exchange works, step-by-step setup, the EKS trap, and a hub-and-spoke design for many accounts.Mon, 19 Oct 2026 00:00:00 GMTsecuritygcpawsworkload-identityiameksmulti-cloudhttps://platformnews.net/en/blog/workload-identity-federation-gcp-to-aws/https://platformnews.net/en/blog/workload-identity-federation-gcp-to-aws/Let GCE, Cloud Run, Cloud Functions and GKE workloads call AWS with temporary credentials: Google ID tokens and AssumeRoleWithWebIdentity, the trust-policy mistake that opens your role to the whole internet, the GKE OIDC path, and Terraform for both sides.Mon, 19 Oct 2026 00:00:00 GMTsecurityawsgcpworkload-identityiamgkemulti-cloudhttps://platformnews.net/en/blog/aws-controllers-for-kubernetes/https://platformnews.net/en/blog/aws-controllers-for-kubernetes/How ACK lets each app's Helm chart own its buckets, queues and databases — and how kro gets values like DATABASE_URL into the Deployment automatically, with no copy-paste.Sun, 18 Oct 2026 00:00:00 GMTkubernetesawsackkrohelmgitopsekshttps://platformnews.net/en/blog/eks-pod-identity-vs-irsa/https://platformnews.net/en/blog/eks-pod-identity-vs-irsa/How pods get AWS credentials without static keys — how IRSA and EKS Pod Identity work under the hood, where they differ, and how to migrate safely.Sun, 18 Oct 2026 00:00:00 GMTsecurityawseksiamirsapod-identityworkload-identityhttps://platformnews.net/en/blog/slo-101/https://platformnews.net/en/blog/slo-101/A practical first SLO with Prometheus: pick an SLI users actually feel, turn 99.9% into an error budget, write the recording rules, add multiwindow burn-rate alerts with unit tests, and agree on an error budget policy.Fri, 16 Oct 2026 00:00:00 GMTsreslosreobservabilityprometheusalerting