About

NAME

gke, infrastructure and platform engineer, who builds with in mind whoever would like to slip in.

SYNOPSIS

gke [-industrialize] [-secure] [-debug] [-repurpose] [-teach] [-infer] [-lead] problem...

DESCRIPTION

gke takes as input what cannot be reproduced, a fleet whose history nobody remembers anymore, a deployment done by hand on an on-call night, a production nobody dares touch anymore and returns it idempotent, then immutable, replayable by anyone on the team. He always starts by understanding what exists before replacing it, because a production that runs, even badly, carries years of decisions nobody ever wrote down. He took on responsibilities one by one, from fixing machines to running entire infrastructures, without ever letting go of the keyboard along the way and never assumes the fleet will be clean or uniform, which is often precisely when he is needed most.

OPTIONS

-industrialize

From the IoT device and the edge site to the physical server booting over PXE, from the unikernel to the VM by way of the microVM and the container and from private cloud to public cloud without forgetting the hybrid that ties them together, with the same requirement everywhere, that the machine be described in git before it exists and that it can be destroyed without regret. Linux, BSD, Windows, macOS and network gear live side by side in the same chain, because the reality of a fleet has rarely read the documentation.

-secure

Secure by design, from recompiling the kernel to pinning container images by digest, by way of SSH bastions , an internal PKI that speaks ACME , secrets that no longer lie around in repositories and images rebuilt from source to know what they really carry. The attacker’s eye goes back a long way, to an Action Replay reading the memory of a Super Nintendo and it asks of every platform the questions of a patient intruder, not how to break it but how to slip in, stay, clean up behind oneself and get the data out through a channel nobody watches, so that the answer is always the same, nowhere.

-debug

From 90s crackmes to remotely steering teams of third-party technicians on a heterogeneous infrastructure on the other side of the world, he goes down to the layer where the problem really lives, from strace to the disassembler , from a .jar decompiled for lack of sources to a JVM crash dump with an EDR’s DLL lurking at the bottom, by way of the cascade a dirty power cut leaves behind. He then writes the post-mortem, including when the culprit is himself and he even happens to debug his own intuitions , with the same method and a segfault at the end when they take themselves for theories.

-repurpose

Makes tools do what they were never meant for, an Action Replay to read a console’s memory, a captive portal that filters only HTTP but resolves any name and therefore hands the internet to whoever speaks DNS, git hooks to drive server fleets, a meeting-room status light to show the state of the CI, because understanding a system also means knowing how far it will bend.

-teach

Has been chatting on IRC since 1998, spent his evenings until the late 2000s on computer forums helping strangers fix and tune their machines, learn to code or debug their own code, has been publishing what he learns since 2006 and contributes to open source, but it is elsewhere that passing things on will have mattered most. He has helped colleagues prepare for their engineering competitive exams, which they passed, taught programming to youngsters as well as to technicians who wanted to go further, supported adults retraining for a new career and passed the bug on to interns as well as to kids met in video game communities. Some became engineers, architects or developers and every now and then one of them comes back to thank him ten, fifteen or twenty years later, which probably remains the only metric he is truly proud of.

-infer

From inference on local GPUs or GPUs pooled between peers, to sharing model weights peer to peer , by way of agents that review one another before anyone trusts them, always with two questions before plugging a model in anywhere, does it solve a problem or does it decorate a slide and above all which data goes where, by which path and who will be able to read it afterwards.

-lead

Experimental option, but oddly very stable. There was a time when his documentation read like a script, numbered from 4.1.2 to 5.3.4, riddled with “if such a case, refer to 3.5.3”, perfectly executable by a machine and more or less unreadable for his colleagues, until the day he understood it was often better to send them an email, or at worst to talk to them ;) He works collegially, with a remote culture forged in open source and it is with autonomous juniors as with highly specialized profiles that he will always have given his best, guiding, challenging and arbitrating according to his perception of the project’s needs, which the team takes care to update often. His authority rests mostly on his reasoning, which would become a flaw the day a junior did not dare challenge him when they should and that is precisely the day someone should tell him.

EXIT STATUS

0 when the hundredth machine is identical to the first. A published post-mortem in every other case.

HISTORY

A cassette-loading VTech Laser 500, still stored in its case. An Action Replay on the Super Nintendo, then on the PlayStation, to freeze the game, read the memory, change a byte and see what breaks, reverse engineering before knowing the word. DOOM, Quake, Warcraft, StarCraft, Unreal Tournament, Half-Life and Counter-Strike and the LAN parties that went with them. Internships at repair shops and in cybercafés, then fixing machines for individuals and businesses alike, the best school for learning that a broken machine always has an owner in a hurry. Debian in 2001 and with it the conviction that everything must be scriptable. Nights on IRC, sockets written in C with nothing but the man pages and packets forged by hand , to see what the network answers when you talk to it differently. An exploitation harness grafted onto GDB in 2006, because driving your debugger in Perl is the bare minimum when you are lazy. Rewritten in Prolog in 2009, because when it comes down to it, it is better when the machine writes the scripts for you. Twenty years later, a neuro-symbolic pipeline, out of which came augure and lictor . Game server fleets driven by git and its hooks, GitOps before the word existed , then Puppet, Ansible, Terraform and immutability. And this blog, opened in 2006, closed and reopened several times, which also tells what did not work.

BUGS

Publishes his own mistakes, down to the RCE found in his own Vim plugin manager . Asks “why” before “how”, which sometimes lengthens meetings and always shortens post-mortems. Cannot come across a black box without reaching for the screwdriver, which partly explains everything above. Allergic to theater, the :ro on a socket that speaks as root, obscurity taken for security , the backup never restored . Is wary of a production that runs too well, because a careful intruder would gladly optimize it so you look at it less. Recompiles his kernel for fun, which is not a bug but sometimes worries those around him.

REPORTING BUGS

gke@6admin.io