Peter Lee - Blog

Local DNS for home Kubernetes: tracing resolver loops from the router to CoreDNS

peterlee0127@gmail.com (peterlee) — Mon, 14 Sep 2026 00:00:00 +0800

Opening GitLab in a browser does not prove that Argo CD can clone its repository. Resolving a Registry name on the NUC does not prove that a Pod or the container runtime uses the same DNS path. Once browser-facing access and internal machine access are separated, a single claim that “DNS works” stops being useful.

Persist Vault audit logs on the host: permissions, HUP, and 90-day rotation

peterlee0127@gmail.com (peterlee) — Wed, 09 Sep 2026 00:00:00 +0800

A Vault server that delivers secrets successfully does not necessarily leave the evidence needed to explain who performed an API operation. Container server logs describe process state and errors. Audit devices record API requests and responses. Seeing output from docker logs vault does not prove that both exist.

Running Qwen3.6 and Qwen3.8 in LM Studio on an M5 Pro

peterlee0127@gmail.com (peterlee) — Fri, 04 Sep 2026 01:05:00 +0800

Installing a local large language model on an M5 Pro is straightforward. Choosing the right model format and leaving enough unified memory are the parts that need more attention. I use two 4-bit MLX models in LM Studio: Qwen3.6 35B A3B and Qwen3.8 27B. Their model files are about 20.43 GB and 16.08 GB respectively. Both support text, images, and reasoning, but their architectures and best uses differ.

Distribute Registry credentials across namespaces with ClusterExternalSecret

peterlee0127@gmail.com (peterlee) — Wed, 02 Sep 2026 00:00:00 +0800

A Deployment can look correct in a new namespace while its Pod stays in ImagePullBackOff. The Pod references regcred, but that Secret exists only in another namespace. Copying it once is easy. Repeating the copy for every workload and every credential rotation is the maintenance problem.

A Kubernetes MCP Tool That Can Look but Not Touch

peterlee0127@gmail.com (peterlee) — Fri, 28 Aug 2026 00:00:00 +0800

I recently built an MCP tool in k8s_infra/plugins/infra-observer for AI-assisted infrastructure triage. It is not a wrapper around a remote terminal, and it does not hand kubectl to a model. Its job is narrower: give the model enough information to investigate a problem without letting it change the environment.

Helping AI Understand My Kubernetes Infrastructure

peterlee0127@gmail.com (peterlee) — Fri, 28 Aug 2026 00:00:00 +0800

When I first brought AI into my Kubernetes workflow, the problem was not that it could not write YAML. The problem was that it could write YAML after looking at only one file. It could quickly produce a Deployment without knowing whether the service belonged behind Argo CD, where its Secret came from, or whether the public entry point also needed work outside the cluster.

Run Airflow on Kubernetes with GitOps-managed values

peterlee0127@gmail.com (peterlee) — Mon, 24 Aug 2026 00:00:00 +0800

Apache Airflow runs as a GitOps-managed platform service in my home Kubernetes cluster. It orchestrates scheduled data work and operational workflows, while Kubernetes provides an isolated runtime for the scheduler, API server, Celery workers, triggerer, and their supporting services.

Replace Caddy with cloudflared: expose Kubernetes without opening ports 80 and 443

peterlee0127@gmail.com (peterlee) — Sat, 22 Aug 2026 00:00:00 +0800

My k8s_infra setup originally used Caddy as a local web reverse proxy. External requests reached Cloudflare first, entered my home network through forwarded HTTP or HTTPS ports, arrived at Caddy, and were finally sent to Kubernetes.

Remove an accidentally committed secret from Git—locally and remotely

peterlee0127@gmail.com (peterlee) — Thu, 30 Jul 2026 00:00:00 +0800

This incident started with an ordinary side-project task. The project consumed several CSV files from external sources, and some of those files contained confidential data that should never have been versioned. While preparing the data for the project, I accidentally added one of the sensitive CSV files to the Git repository without noticing.

Building a Native Encrypted DNS App for macOS with AI Coding: DNS Security Pro

peterlee0127@gmail.com (peterlee) — Sat, 18 Jul 2026 00:00:00 +0800

DNS Security Pro for macOS lets users switch between DNS over HTTPS (DoH) and DNS over TLS (DoT) profiles and see which profile is active. I built it with SwiftUI, the AppKit lifecycle, and Apple’s NetworkExtension APIs as an independent macOS app, rather than porting the iOS interface through Mac Catalyst.

Use Mozilla SOPS with GitOps for encrypted Kubernetes Secrets

peterlee0127@gmail.com (peterlee) — Tue, 09 Jun 2026 00:00:00 +0800

SOPS lets a GitOps repository hold encrypted Kubernetes Secret values. The controller decrypts them during deployment:

encrypted Secret in Git -> GitOps controller decrypts -> Kubernetes Secret -> Pod

Vault supplies runtime values from a secret manager; SOPS uses the encrypted files in Git as the source of truth. Choosing SOPS means protecting the decryption key alongside the infrastructure needed to rebuild the cluster.

Run Istio ambient mode with waypoint proxies

peterlee0127@gmail.com (peterlee) — Wed, 03 Jun 2026 00:00:00 +0800

I use Istio ambient mode to enroll namespaces in the mesh without adding a sidecar to every Pod. Ztunnel handles secure L4 traffic; I add a waypoint to services that need L7 routing, authorization, or telemetry.

Bootstrap a new RKE cluster for GitOps