Recent content on Marks Blog
You have a GitOps repo. It has 35 kustomization.yaml files across clusters, components, demos, and tests. You want CI to validate that your manifests actually build. Simple enough — run kustomize build on each one and fail the pipeline if anything breaks. Except it’s not that simple. The Problem There are three obvious approaches, and they all have problems. Build everything. Walk the repo,…
When I open-sourced the eBPF BNG last month, someone on Hacker News called it “vibe coded.” I understand why. The project moved fast — a working distributed BNG with eBPF/XDP packet processing, DHCP, RADIUS, NAT, PPPoE, BGP, and a coordination service, all open-sourced within weeks. That’s suspicious. When something appears quickly, people assume it was thrown together quickly.…
A month ago I wrote about building an eBPF-accelerated BNG and the infrastructure repo that lets you run it locally. The response was better than I expected — the post hit 94 points on Hacker News and sparked some good discussion. It also sparked some fair criticism. One commenter called the code “vibe coded.” Another wrote a detailed comment about why distributed BNG has never…
Last week I open-sourced the eBPF BNG itself. The response was great, but the most common question was: “How do I actually run this thing?” Fair question. The BNG repo has a Dockerfile and some example configs, but spinning up a distributed system with multiple components, observability, and realistic test traffic isn’t trivial. That’s the hard part of infrastructure - not…
I used to work for an ISP startup that was building next-generation infrastructure. The company didn’t make it, but the problems we were trying to solve stuck with me. So I spent a few weeks building what we never got to: an open-source, eBPF-accelerated BNG that runs directly on OLT hardware. This post explains the architecture and why I think it’s the future of ISP edge…
Introduction If you’ve spent any time working with Kubernetes, you’ve probably heard of GitOps -a methodology that treats Git as the source of truth for defining and operating infrastructure and applications. In this post, I’ll walk you through a GitOps setup that uses a hierarchical folder structure, combining Helm, Helmfile, and Kustomize to give you robust, testable, and scalable deployments.…
Introduction A common pattern I see promoted is using tools that show you what will change in your cluster at sync time - after your code is already merged. In my view, this is already too late and goes against GitOps principles. How can Git be the source of truth if there are extra steps between merge and understanding impact? In this post, I’ll show you how to generate manifest diffs…
Sometimes when you’re developing or debugging locally you need access to resources that are exposed to your cluster. Typically, most organisations use VPN’s to enable you to access these resources, but there’s a much easier way. Socat. The alpine/socat image is perfect for enabling backdoor access to private or internal services that are available to your cluster without having…