Any Keycloak from 20 onward enforces the openid scope on /userinfo, which breaks Mattermost Team Edition’s Keycloak-as-GitLab SSO. The fix everyone tries first makes it worse. Here’s what actually breaks, and the one client scope on Keycloak’s side that makes it work.
Finer-grained Kubernetes access control and an audit trail that names a human — with KubeAid + NetBird, and no OIDC in your API server.
A walkthrough of Obmondo Code, an SRE co-pilot CLI built in Go that connects an AI agent to 290+ diagnostic runbooks, SSH command execution, Gitea issue parsing, and time registration — with a strict safety model baked into every layer.
Artoo, Obmondo’s Mattermost bot, got a PR review engine that runs on a self-hosted Qwen3-14B with a ~32K context window. The key problem: a single Kubernetes PR can have 10,000+ lines of diff. The solution: Go pre-processing that compresses diffs to ~2KB before the LLM ever sees them — using go/ast for Go files, YAML key-level diffing for Helm/K8s configs, and priority-based file truncation. This post covers why each decision was made and what the LLM still cannot do.
The Symptom After standing up a Kubernetes cluster on a bare-metal node with Cilium as the CNI, CoreDNS pods were running but completely unable to reach the kube-apiserver service IP (10.96.0.1). DNS resolution inside the cluster was broken, and any pod trying to talk to the API server via the service IP timed out. The apiserver itself was healthy — direct connections to the node’s IP worked fine. The problem was specifically with the virtual service IP routed through Cilium’s BPF dataplane. ...
Two bugs surfaced during a CEO-plan audit of the vuls-exporter codebase that are easy to introduce and silent enough to survive code review. Both involve standard-library primitives that look correct but fail quietly on Linux. The bugs at a glance filepath.Glob("**/*.json") does not recurse on Linux — it matches nothing in subdirectories and returns nil, nil. Raw unix.InotifyAddWatch does not automatically watch new subdirectories — any directory created after the watch is set up is silently ignored. Bug 1: filepath.Glob does not support ** The code looked like this: ...
security-exporter returned 0 CVEs on every CentOS and RHEL host. The root cause was a silent data drop: ParsePackages silently skips any line that does not match its exact tab-separated format, and our rpm collector was producing the wrong format. This post covers the full diagnosis, the fix using the vuls-recommended 6-field rpm query, source package extraction using the NVR last-two-hyphens algorithm, and the Helm chart simplification that removed the entire legacy go-cve-dictionary + PostgreSQL pipeline.
A hands-on record of every error encountered upgrading from vLLM v0.9.2 to v0.17.0 with Qwen models on an RTX 4000 Ada (20GB VRAM): deprecated CLI flags, CUDA runtime changes, entrypoint conflicts, tool-call parser requirements, unsupported transformers, and how to pick the right quantized model for 20GB VRAM.
octocatalog-diff is a great tool for surfacing Puppet catalog changes in pull requests, but its default CI behaviour has two sharp edges: it exits with code 2 when diffs are found (which most CI systems treat as failure), and its stderr is full of Ruby thread noise and stack traces that obscure the actual compilation errors you care about. Here is how we fixed both. The Exit Code Problem octocatalog-diff uses three exit codes: ...
A complete journey of getting vLLM + Qwen2.5-14B-AWQ running on an RTX 4000 Ada with working tool calls for OpenCode: CUDA driver setup, throughput debugging, AWQ Marlin kernels for sm_89, writing a custom Qwen tool parser plugin, and debugging model refusals caused by a reasoning:true misconfiguration.