Cilium 1.20 ExternalAuth vs oauth2-proxy vs Istio AuthorizationPolicy
Cilium 1.20 ships the Gateway API ExternalAuth filter from GEP-1494. How it compares with oauth2-proxy and Istio, and why Experimental matters.
Kubernetes Pod Certificates vs SPIFFE/SPIRE vs cert-manager: Choosing Workload mTLS in 2026
Pod certificates went stable in Kubernetes v1.37. How built-in pod certs compare with SPIFFE/SPIRE and cert-manager on trust, rotation and cost.
SPIFFE & SPIRE: Workload Identity Architecture for Zero Trust (2026)
SPIFFE and SPIRE workload identity explained: SPIFFE IDs, X.509 and JWT SVIDs, node and workload attestation, trust domains and mTLS - the reference architecture for zero-trust service identity in 2026.
MCP Server Security Architecture: Defending Model Context Protocol Tools (2026)
MCP server security architecture: tool poisoning, indirect prompt injection, OAuth 2.1, sandboxing, least privilege, and a defense-in-depth model for Model Context Protocol.
Zero Trust Architecture for Industrial OT / IoT (2026)
Zero-trust architecture for industrial OT and IoT — micro-segmentation patterns, identity for machines, NIST SP 800-207 applied to plants, and what the Purdue model gets wrong.
DMZ and Port Forwarding: Secure Remote Access Architecture
DMZ and port forwarding done safely — network segmentation, NAT and firewall rules, port forwarding vs VPN vs reverse proxy, and a hardened reference setup.
Zero Trust Network Architecture Implementation Guide: From NIST 800-207 to Production
Practical zero trust architecture — policy decision point, policy enforcement point, mTLS, SDP, identity-aware proxies, and migration from perimeter-based networks.