Mark Whitby

Cursor Origin is live, with Depot as one of the first 3 official integrations! You can easily 'depot ci migrate' your existing GitHub Actions workflows to Depot CI, which works out of the box with Origin’s code hosting. Origin + Depot = Better CI workflows without relying on GitHub. https://lnkd.in/g3HfWvFB

17

I don't normally advertise my blog but while preparing the ifnot200 beta I realised I can add a read only MCP endpoint to my services to help debug. If you're running something or a few things, consider adding one. ChatGPT, Claude, or whatever you use can then investigate the data sources directly. https://lnkd.in/ekZCbNaP

5

Moving from VMware to OpenShift Virtualization? One of the biggest concerns I hear from Infrastructure Architects: "How do I get the same level of DR protection I had before?" The answer is here. InfoScale for Kubernetes now delivers true enterprise-grade disaster recovery for OpenShift Virtualization — with continuous block-level replication, near zero RPO, automated failover, and zero vendor lock-in. https://lnkd.in/eVxnpC_n No more snapshot-based compromises. No more RPO measured in hours. Check out my latest article on how this changes the game for mission-critical workloads #OpenShift #Kubernetes #VMware #DisasterRecovery #CloudNative

41

Cloudflare published an excellent postmortem (https://lnkd.in/eATRP454) about their November outage - and like all great engineering write-ups, it’s a reminder of something I’ve learned again and again: Most failures don’t come from malicious actors. They come from small, innocent assumptions that quietly cascade. In this case, it wasn’t an attack. It wasn’t a hardware failure. It wasn’t even a huge architectural flaw. It was a permissions change → duplicate rows → a config file doubling in size → hitting a memory limit → a panic in the proxy → global 5xxs. A tiny crack in a massive, brilliant system. And it’s a perfect example of why I’ve always built software with the worldview that: If something can fail, it eventually will fail - so your job is to design for recovery, not perfection. In the fintech products I’ve built (Letter, WorkMade, various banking systems), that mindset became non-negotiable: • Masking internal IDs because one assumption can cause an IDOR. • Declarative auth because scattered permissions create invisible exhaust ports. • Event sourcing because state lies, but logs don’t. • Zero-trust internal APIs because failures usually come from “trusted” paths. • Safe defaults and kill-switches because rollbacks should be boring. • Immutability and auditability because narrative matters more than state. The older I get, the more I appreciate the engineering teams who write postmortems like Cloudflare’s - not because something went wrong, but because they show how seriously they take building for failure. Anyone can design a happy-path system. Very few can design one that survives reality. And that’s the work I love most. Designing resilient systems. Finding the exhaust ports before attackers or accidents do. Building architectures that bend, not break. Making failure a first-class consideration, not an afterthought. Cloudflare will come out of this even stronger - they always do. And if your team is thinking about resilience, threat modelling, failure modes, or re-architecting critical systems in 2026… happy to chat. benhowdle.im

4

Scaling GitHub Copilot agents across teams? Most organisations are struggling with duplication and context pollution. The Problem: Teams often work in isolation, each building their own custom agents, skills, prompts and instructions. This leads to no reusability across the organisation and incorrect use of the primitives — agents become tightly coupled with project domain knowledge instead of remaining generic orchestrators. The Solution: Microsoft’s open-source Agent Package Manager (APM) combined with a clean architecture: - Thin routing Instructions that detect context and point to the right Skill - Heavy on-demand Skills carrying domain knowledge - Generic Agents (developer, tester, etc.) instead of an N×M explosion - Parameterised Prompts for repeatable workflows - Declare everything once in apm.yml, run apm install, and every repository gets a consistent, governed, portable agent setup. This is a game-changer for enterprise AI-native SDLC. Check out the project: https://lnkd.in/eMEE6a_5 Have you tried APM yet? Share your biggest agent customisation pain point below. #GitHubCopilot #AIagents #AgenticWorkflows #DeveloperExperience #APM cc: Daniel Meppiel Sebastien DEGODEZ

42

1 Comment

I built a Kubernetes operator in my spare time to automate the plumbing required to set up OIDC federation between OpenShift and Microsoft Entra ID, enabling Azure Workload Identity. I wanted to gain some hands-on experience writing a Kubernetes operator, while also solving a concrete problem we were facing at work at the time. We needed to get Azure Workload Identity in place, and the setup involved enough moving parts that it felt like a good candidate for reconciliation rather than a collection of scripts and manual steps. The operator manages the Azure workload identity infrastructure and the cluster’s OpenID Connect issuer integration, with a focus on explicit resource ownership, drift reconciliation, safe deletion, signing-key rotation, and recovery of retained workload identities. Interestingly, the project did not start in Go. My first implementation was written in Rust using kube-rs. I had a lot of fun with it, and I came away genuinely impressed by kube-rs and its relatively simple approach to writing Kubernetes controllers. But at some point I had to separate “this is fun to build” from “I would be comfortable operating this in a customer environment”. I found myself having to build or integrate more of the surrounding machinery myself, particularly around things such as Azure SDK integration and leader election. For an operator intended to manage production infrastructure, that tradeoff stopped making much sense. So I scrapped the Rust implementation and rewrote the operator in Go using Kubebuilder. The Kubernetes ecosystem already has a mature, community-native framework for building operators, with well-established patterns and libraries for controllers, reconciliation, leader election, metrics, health checks, and the rest of the operational plumbing. In this case, choosing the boring and established path felt like the responsible engineering decision. Still, experimenting with kube-rs was absolutely worthwhile. It gave me a different perspective on controller development, and I would happily use it again where the operational constraints make sense. The project is open source, and contributions are very welcome. If the project gains enough traction and there’s interest from others using it, I might also spend some time going through the Red Hat certification process and making it available as a Certified Operator in OpenShift OperatorHub. For now, though, I’d love to hear whether this solves a problem for anyone else. https://lnkd.in/erDBk4bw

33

4 Comments