From Bare Metal to Production-Grade Kubernetes — Real Engineering, No Shortcuts

BUILDING MIRECLOUD A Production-Grade Kubernetes Homelab from Scratch BARE METAL · GITOPS · ZERO TRUST · OBSERVABILITY · LLM Kubernetes Cilium Keycloak Vault ArgoCD eBPF OIDC Prometheus 🐙 github.com/mirecloud/home_lab A journey through bare metal, GitOps, OIDC, and the beautiful chaos of running enterprise-grade infrastructure in your living room. There's a specific kind of madness that grips platform engineers at some point in their career. It usually starts with an innocent thought: "I should have a homelab." Then you buy one server. Then two. Then you're configuring etcd, arguing with NFS mount options at 1 AM, and explaining to your partner why the internet is down because you're "testing Cilium network policies." Welcome to MireCloud — my bare-metal Kubernetes homelab, built to mirror what real production infrastructure lo...

  Series Recap: So at this point in the MireCloud build, I've got OIDC working. Every kubectl call is authenticated through Keycloak , users get their groups injected into the JWT, and RBAC bindings match on oidc:k8s-viewers exactly as expected. It feels good. Then a thought hit me: I have no idea what's actually happening in this cluster. I can control who's allowed to do things. But if someone lists Secrets, deletes a Pod, or pokes around somewhere they shouldn't—I have zero trace of it. To learn production patterns, I needed to close that gap. This post is about enabling Kubernetes Audit Logging and shipping those events into Loki . A Quick "Why Loki?" Answer I already run Loki for application logs. Promtail is already a DaemonSet. Grafana is my single pane of glass. Adding a dedicated SIEM or an ELK stack just for audit logs would mean more overhead and a second query language. Loki fits naturally here. It’s low overhead, uses the same tooling, an...

Mirecloud — Production Engineering How I Eradicated Static Kubernetes Credentials with Zero Trust OIDC From the nightmare of admin.conf to Keycloak SSO with centralized RBAC. A complete production architecture explained from A to Z. By Emmanuel Catin Kubernetes v1.34 Keycloak (Quarkus) Zero Trust kubelogin v1.35.2 Table of Contents 1. The Illusion of Security & The "Ghost" in the Machine 2. The Concept: Architecture & Authentication Flow 3. Phase 1 — Keycloak Configuration (The Easy Way) 4. Phase 2 — Mutating the Kubernetes API Server 5. Phase 3 — The RBAC Bridge (Authorization) 6. Phase 4 — The Developer Experience (Client Demo) 7. Knowledge Base: Troubleshooting 8. What's Next: Part 6 — Audit Logging & Observability 1. The Illusion of Security & The "Ghost" in the Machine ...