A human at a terminal, a browser session behind SSO, an AI agent running Terraform on my behalf — none of them get a standing key. Every one of them authenticates, is issued a short-lived credential, and is audited the same way. This is that access model, the infrastructure it protects, and a real application running on top of it.
"Zero trust" is easy to say about SSH and forget everywhere else. Here it applies uniformly — to the person operating the infrastructure, to whoever uses the application running on it, and to the AI tooling that now writes a good share of the Terraform and Ansible itself.
Every change starts on one workstation with no fixed credential. A client certificate buys a session-scoped Vault token. Away from home, a Tailscale mesh makes the LAN reachable first — the same Vault/Boundary flow then runs exactly as if I were physically there.
The public domain resolves through Cloudflare's edge into an outbound-only tunnel running inside the cluster — no port ever opened on the home network. From there, login is one OIDC exchange against the identity provider; the app never handles a password.
Claude, Gemini, and local models via Ollama write and run Terraform, Ansible, and Kubernetes changes on this environment — through the same workstation, under the same short-lived Vault credential as a human session. No separate service account, no wider scope, no standing key issued just because the operator is an AI this time.
Two hypervisors carry a Ceph-replicated storage pool underneath a kubeadm-built Kubernetes cluster and a dedicated identity stack. Nothing is reachable except through the broker below.
Click any box for detail · open the full network diagram ↗
Select a node above to see what runs there and why it matters.
There is no VPN client and no key sitting on disk. Reaching any host — even the ones I administer daily — goes through the same three-step exchange.
The workstation authenticates with a client certificate. In exchange it receives a token — nothing longer-lived than the task at hand.
The vault's SSH engine signs a fresh client certificate scoped to one principal. It self-invalidates five minutes later, no revocation step needed.
ttl 05:00Identity is confirmed via the single sign-on provider, the broker opens an audited tunnel to the target, and the certificate expires the moment the session ends.
| Zero trust | Every SSH session is brokered and audited; no standing VPN exists to the network. |
|---|---|
| Internal PKI | A private root and intermediate CA issue every internal TLS certificate, propagated into Kubernetes automatically. |
| Centralized secrets | One versioned secrets store; nothing sensitive is ever committed to Git in the clear. |
| Temporary credentials | SSH access rides on five-minute certificates — there is no long-lived key to leak. |
| Federated identity | A single sign-on provider fronts every internal application and the access broker itself. |
| Infrastructure as code | The entire environment is defined in version control and rebuildable from it. |
| GitOps | Cluster state is continuously reconciled from Git — no manual `kubectl apply` for anything it manages. |
The cluster above isn't idle. It currently runs a full-stack athlete-performance tracking application I designed, built, and ship updates to on the same pipeline — including the SSO login flow from the access model above.
A FastAPI backend and a React frontend, backed by Postgres and object storage for progress photos, with an LLM integration and a scheduled reporting job.
Next: an OpenShift single-node instance alongside the kubeadm cluster — same workload model, in progress alongside a Red Hat OpenShift certification.