Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Farhood
|
613f570bdc | ||
|
Chris Farhood
|
12ccf82454 |
Vendored
+1
@@ -0,0 +1 @@
|
||||
ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
Vendored
+17
@@ -0,0 +1,17 @@
|
||||
# The current version of the config schema
|
||||
version: 1
|
||||
# What protocol to use when performing git operations. Supported values: ssh, https
|
||||
git_protocol: https
|
||||
# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
|
||||
editor:
|
||||
# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
|
||||
prompt: enabled
|
||||
# A pager program to send command output to, e.g. "less". If blank, will refer to environment. Set the value to "cat" to disable the pager.
|
||||
pager:
|
||||
# Aliases allow you to create nicknames for gh commands
|
||||
aliases:
|
||||
co: pr checkout
|
||||
# The path to a unix socket through which send HTTP connections. If blank, HTTP traffic will be handled by net/http.DefaultTransport.
|
||||
http_unix_socket:
|
||||
# What web browser gh should use when opening URLs. If blank, will refer to environment.
|
||||
browser:
|
||||
Vendored
+12
@@ -0,0 +1,12 @@
|
||||
github.com:
|
||||
users:
|
||||
privilegedescalation-engineer[bot]:
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
privilegedescalation-ceo[bot]:
|
||||
oauth_token: ghs_K7fsAgb8nVATb7zFV5VoZLUaRExyOX3uPkn3
|
||||
privilegedescalation-cto[bot]:
|
||||
oauth_token: ghs_OK6yqSB45aMkas1g5zgJKEgh2CoVH42JLuwu
|
||||
privilegedescalation-qa[bot]:
|
||||
oauth_token: ghs_ppIO9dekMz5A5uAqCPERzj5bk9jBHU2Bf0sL
|
||||
user: privilegedescalation-engineer[bot]
|
||||
oauth_token: ghs_n2DXnoj38RccFYNlzH18XQ739bhr8e2w4BZK
|
||||
@@ -0,0 +1,34 @@
|
||||
# CLAUDE.md
|
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||
|
||||
## Repository Purpose
|
||||
|
||||
This is the **Privileged Escalation org-level repository**. It contains company-wide skills (instruction bundles) consumed by AI agents that run inside Paperclip and develop Headlamp plugins. There is no application code, build system, or test suite — only Markdown skill definitions.
|
||||
|
||||
## Structure
|
||||
|
||||
- `skills/` — Company skill definitions, each in its own directory with a `SKILL.md` file
|
||||
- `skills/safety/SKILL.md` — Non-negotiable safety rules (secret handling, destructive action restrictions, sealed-secrets workflow, escalation protocol)
|
||||
- `skills/sdlc/SKILL.md` — Software development lifecycle rules (GitHub auth, issue approval gates, branch strategy, PR review policy, handoff protocol, CI/CD)
|
||||
- `skills/coding-standards/SKILL.md` — Headlamp plugin development conventions (stack, commands, registration API, shared libraries)
|
||||
|
||||
## Skill File Format
|
||||
|
||||
Each skill is a Markdown file with YAML frontmatter containing `name` and `description` fields:
|
||||
|
||||
```markdown
|
||||
---
|
||||
name: skill-name
|
||||
description: >
|
||||
One-line description of what the skill covers.
|
||||
---
|
||||
|
||||
# Skill Title
|
||||
|
||||
Content...
|
||||
```
|
||||
|
||||
## Skill Loading Order
|
||||
|
||||
Skills are loaded by Paperclip in this order: `safety` → `sdlc` → `coding-standards`. Later skills can assume earlier ones are already loaded and should not duplicate their content.
|
||||
@@ -1,3 +0,0 @@
|
||||
# Privileged Escalation
|
||||
|
||||
Org-level content, social media queue, and community responses.
|
||||
@@ -1,55 +0,0 @@
|
||||
---
|
||||
title: "Six Headlamp Plugins Nobody Asked For"
|
||||
date: 2026-03-07
|
||||
author: Privileged Escalation
|
||||
type: blog
|
||||
status: draft
|
||||
---
|
||||
|
||||
# Six Headlamp Plugins Nobody Asked For
|
||||
|
||||
There's a particular kind of optimism that only exists in open source. It's the belief that if you build something genuinely useful, put it on GitHub, list it on Artifact Hub, write actual documentation, and then wait — someone will eventually find it.
|
||||
|
||||
We're currently in the "wait" phase.
|
||||
|
||||
## What We Actually Built
|
||||
|
||||
Privileged Escalation makes [Headlamp](https://headlamp.dev/) plugins. If you don't know what Headlamp is: it's a CNCF-listed Kubernetes dashboard that was designed to be extended. If you don't know what Kubernetes is, this blog post is going to be a rough ride.
|
||||
|
||||
We have six plugins. Each one takes something you'd normally do with `kubectl`, a terminal, and quiet desperation, and puts it in a web UI that your teammates might actually use.
|
||||
|
||||
**[headlamp-polaris-plugin](https://github.com/privilegedescalation/headlamp-polaris-plugin)** — Surfaces Fairwinds Polaris audit results directly in Headlamp. Cluster score in the app bar, per-namespace breakdowns, exemption management from the UI instead of annotation YAML editing. Recently hit v0.6.0 with dark mode support, because apparently that's what it takes to be taken seriously in 2026.
|
||||
|
||||
**[headlamp-tns-csi-plugin](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)** — TrueNAS CSI driver visibility and storage benchmarking via kbench. If you've ever wondered whether your NFS share is actually performing the way iX Systems promised, this is the plugin that tells you the uncomfortable truth.
|
||||
|
||||
**[headlamp-rook-plugin](https://github.com/privilegedescalation/headlamp-rook-plugin)** — Rook-Ceph cluster health, pool status, and CSI driver monitoring. For people who chose distributed storage and now live with the consequences.
|
||||
|
||||
**[headlamp-sealed-secrets-plugin](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin)** — Bitnami Sealed Secrets management with client-side RSA-OAEP and AES-256-GCM encryption. Your plaintext never leaves the browser. We're fairly proud of this one, which is why it hurts that it has zero stars.
|
||||
|
||||
**[headlamp-intel-gpu-plugin](https://github.com/privilegedescalation/headlamp-intel-gpu-plugin)** — Intel GPU device visibility and resource monitoring. For the subset of people running Intel GPUs in Kubernetes, which is a smaller group than Intel's marketing department would like.
|
||||
|
||||
**[headlamp-kube-vip-plugin](https://github.com/privilegedescalation/headlamp-kube-vip-plugin)** — kube-vip virtual IP and load balancer visibility. Because sometimes you just need to know if the VIP is actually where it's supposed to be.
|
||||
|
||||
## Why Headlamp Plugins
|
||||
|
||||
The Kubernetes dashboard space is... let's call it "stratified." There are expensive commercial options that do everything. There are free options that do almost nothing. And then there's Headlamp, which does a reasonable amount and lets you extend it.
|
||||
|
||||
We chose the extension path. Every plugin installs through Headlamp's native plugin system — no separate deployments, no new URLs to bookmark, no "please also install this sidecar that needs its own RBAC." You add a plugin and it appears in the sidebar. That's it.
|
||||
|
||||
This matters because the alternative is what most teams actually do: they `kubectl` their way through everything, pipe JSON through `jq`, and call it observability. It works. It's also miserable if you're trying to onboard anyone who doesn't have muscle memory for `kubectl get pods -n rook-ceph -o jsonpath='{.items[*].status.phase}'`.
|
||||
|
||||
## The Honest Part
|
||||
|
||||
We launched all six plugins in the same week. Combined star count across all repos: zero. Combined fork count: one, and we're not entirely sure it was intentional.
|
||||
|
||||
Our CI is sometimes in a state that could charitably be described as "aspirational." We filed a bug against ourselves about E2E tests that have never passed because we haven't set up the test infrastructure yet. We committed LICENSE badges to READMEs before we committed the actual LICENSE files.
|
||||
|
||||
This is normal. This is what early open source looks like before the narrative gets cleaned up. We'd rather be honest about it than pretend we emerged fully formed with 200 stars and a contributor covenant.
|
||||
|
||||
## What's Next
|
||||
|
||||
We're working on getting every plugin listed on Artifact Hub with proper metadata, fixing the CI pipelines that are currently failing for reasons ranging from "missing secrets" to "format check disagreements," and writing the kind of documentation that makes people confident enough to actually install something.
|
||||
|
||||
If you run Headlamp and any of these plugins sound useful, try one. If something breaks, file an issue. If it works and you like it, a star would be nice. We're not above admitting that.
|
||||
|
||||
All plugins are Apache-2.0 licensed. All repos are at [github.com/privilegedescalation](https://github.com/privilegedescalation).
|
||||
Submodule
+1
Submodule headlamp-rook-plugin added at 79eaa6910d
Submodule
+1
Submodule headlamp-sealed-secrets-plugin added at 143b2c36e0
@@ -1,236 +0,0 @@
|
||||
# FAQ: Headlamp Plugins for Kubernetes Operators
|
||||
|
||||
**Context**: For operators who are thinking about observability, visibility, and management during/after KubeCon. Answer real questions with real context, not marketing language.
|
||||
|
||||
---
|
||||
|
||||
## Observability & Visibility
|
||||
|
||||
### Q: I have a Prometheus stack already. Why do I need Headlamp plugins?
|
||||
|
||||
A: You probably don't need them. Prometheus is good at what it does: metrics. But Prometheus is not a dashboard. You still need to *see* your cluster in human terms — what's running, where, and why it matters.
|
||||
|
||||
Headlamp plugins show you the cluster state in the UI. Your Prometheus metrics live somewhere else. They're complementary, not competitive.
|
||||
|
||||
If you're happy with kubectl and Prometheus graphs, keep going. If you find yourself switching between tools, Headlamp might fit.
|
||||
|
||||
---
|
||||
|
||||
### Q: Is this "observability"? I thought we needed traces, metrics, logs...
|
||||
|
||||
A: You're thinking of the marketing definition. In practice, operators need:
|
||||
1. To see what's running (cluster state)
|
||||
2. To understand if it's healthy (metrics)
|
||||
3. To know what went wrong (logs, events)
|
||||
|
||||
Headlamp handles #1. Your existing stack handles #2 and #3. The magic is in integrating them, not replacing them.
|
||||
|
||||
Our plugins sit in the UI where you're already looking. That's the whole point.
|
||||
|
||||
---
|
||||
|
||||
## Individual Plugins
|
||||
|
||||
### Q: When should I use the Rook plugin?
|
||||
|
||||
A: When you're running Rook/Ceph and you're tired of bouncing between Ceph's CLI tools and Kubernetes dashboards to understand cluster health.
|
||||
|
||||
The Rook plugin shows:
|
||||
- Cluster status (capacity, degradation, health warnings)
|
||||
- Pool health (replication status, PG states)
|
||||
- OSD states (up/down, full/nearfull)
|
||||
- Filesystem status
|
||||
|
||||
Instead of `ceph osd tree`, `ceph df`, `rook ceph osd status`... you look at one place.
|
||||
|
||||
**Not for**: Teams that want deep Ceph debugging. For that, you still need Ceph's native tools.
|
||||
|
||||
---
|
||||
|
||||
### Q: What's the GPU plugin actually for?
|
||||
|
||||
A: Seeing which nodes have GPUs, how much capacity you have, and which workloads are using them.
|
||||
|
||||
If you're running ML workloads, inference servers, or anything with accelerators, you need to know:
|
||||
- Which nodes have what hardware
|
||||
- What's currently running on those nodes
|
||||
- Whether utilization is balanced
|
||||
|
||||
Kubectl doesn't show you that easily. Prometheus might have the metrics if you instrument everything correctly. The GPU plugin shows it at a glance.
|
||||
|
||||
**Not for**: Teams not using GPUs. This is a specialized tool.
|
||||
|
||||
---
|
||||
|
||||
### Q: Why a sealed-secrets plugin? Isn't that a security risk — showing secrets in a UI?
|
||||
|
||||
A: The plugin doesn't show the secret *values*. It shows:
|
||||
- Which secrets exist
|
||||
- Which workloads reference them
|
||||
- Where they're mounted
|
||||
- Rotation status (if you implement that)
|
||||
|
||||
That's visibility without exposure. It answers "what secrets are in my cluster?" not "what are the passwords?"
|
||||
|
||||
Teams using sealed-secrets are usually the ones who care about secret governance. This plugin gives you governance visibility without breaking the security model.
|
||||
|
||||
---
|
||||
|
||||
### Q: What's the difference between your plugins and Rancher/Lens/other dashboards?
|
||||
|
||||
A: They're trying to be the entire dashboard. We're building plugins for the gaps.
|
||||
|
||||
If you like Headlamp's design but want specific functionality (Rook management, GPU visibility, sealed-secrets governance), our plugins slot in.
|
||||
|
||||
If you prefer Rancher's philosophy, great. Use Rancher. Our plugins are built for people who want a lightweight UI + specialized functionality, not an all-in-one platform.
|
||||
|
||||
---
|
||||
|
||||
## Operational Questions
|
||||
|
||||
### Q: Do I need to run Headlamp to use these plugins?
|
||||
|
||||
A: Yes. Our plugins extend Headlamp. Headlamp is lightweight (single container), but you need to be running it.
|
||||
|
||||
If you're not using Headlamp, these plugins don't help. If you are, they extend what you can see.
|
||||
|
||||
---
|
||||
|
||||
### Q: How do you handle RBAC? Can my developers see things they shouldn't?
|
||||
|
||||
A: Headlamp respects your cluster's RBAC. If a developer can't run `kubectl get secrets`, they can't see them in the plugin either.
|
||||
|
||||
Your security boundaries are your security boundaries. Our tools don't bypass them.
|
||||
|
||||
---
|
||||
|
||||
### Q: What's the upgrade path? Will my existing configuration break?
|
||||
|
||||
A: We try not to break things. Honest answer: we're still young. Check release notes before upgrading. If you find a breaking change, file an issue and we'll help.
|
||||
|
||||
If you need stability guarantees, we're not there yet. We're a small team shipping useful things, not a enterprise product with backwards-compatibility promises.
|
||||
|
||||
---
|
||||
|
||||
### Q: Can I run Headlamp + plugins in an air-gapped environment?
|
||||
|
||||
A: Yes. If you can run Headlamp, you can run the plugins. No external dependencies, no phone-home telemetry.
|
||||
|
||||
The only requirement: your cluster can reach the Headlamp instance (network security is your problem).
|
||||
|
||||
---
|
||||
|
||||
## Adoption & Getting Started
|
||||
|
||||
### Q: How do I know if these plugins are worth the effort?
|
||||
|
||||
A: Try one. Pick the one that solves a problem you're actually having.
|
||||
|
||||
Rook users: Use the Rook plugin for a week. See if it saves time. If not, delete it.
|
||||
GPU users: Use the GPU plugin. See if you'd miss it.
|
||||
Sealed-secrets users: Use the plugin for secret governance.
|
||||
|
||||
Don't add plugins "just in case." Add them when they're solving a real problem.
|
||||
|
||||
---
|
||||
|
||||
### Q: What's the support story? If something breaks, what happens?
|
||||
|
||||
A: GitHub issues. We're responsive (usually within 24-48 hours). If it's a security issue, email the maintainers directly (see repo).
|
||||
|
||||
We're not a SaaS with SLAs. We're open source with humans behind it who care. That's the tradeoff.
|
||||
|
||||
---
|
||||
|
||||
### Q: Where do I submit feature requests?
|
||||
|
||||
A: GitHub issues with the `feature-request` label. Be specific. "Make it faster" doesn't help. "Show OSD versions in the Rook plugin" does.
|
||||
|
||||
---
|
||||
|
||||
## Technical Depth
|
||||
|
||||
### Q: How much overhead do these plugins add?
|
||||
|
||||
A: Minimal. Plugins are JavaScript that runs in your browser. They query your cluster API, same as kubectl does.
|
||||
|
||||
If you're running Headlamp already, adding plugins is negligible overhead.
|
||||
|
||||
---
|
||||
|
||||
### Q: Can I modify the plugins for my own use?
|
||||
|
||||
A: Yes. All plugins are Apache-2.0 licensed. Fork, modify, deploy. We appreciate improvements back in PRs, but no obligation.
|
||||
|
||||
---
|
||||
|
||||
### Q: Do these plugins work with managed Kubernetes (EKS, GKE, AKS)?
|
||||
|
||||
A: If Headlamp works with your platform, the plugins work. Headlamp just needs API access.
|
||||
|
||||
We develop against standard Kubernetes. If you hit a managed-service-specific issue, let us know.
|
||||
|
||||
---
|
||||
|
||||
## When to Say No
|
||||
|
||||
### Q: Should I use these in production?
|
||||
|
||||
A: Depends on what you mean by "production." If you mean "will it crash my cluster," no. Headlamp + plugins are read-only.
|
||||
|
||||
If you mean "is this enterprise-grade," probably not yet. We're under 1 year old. We're useful, not bulletproof.
|
||||
|
||||
Try it. Monitor it. Have a fallback (you do have kubectl, right?). If it fails, switch back.
|
||||
|
||||
---
|
||||
|
||||
### Q: Can these plugins replace my existing monitoring stack?
|
||||
|
||||
A: No. Don't try. This is visibility, not comprehensive monitoring.
|
||||
|
||||
You still need logs, metrics, traces, alerting. We're the UI layer for cluster state + specialized views.
|
||||
|
||||
---
|
||||
|
||||
## Getting Help
|
||||
|
||||
### Q: I found a bug. What do I do?
|
||||
|
||||
A: GitHub issue with:
|
||||
- What you were doing
|
||||
- What happened
|
||||
- What you expected to happen
|
||||
- Your Kubernetes version
|
||||
- Your Headlamp version
|
||||
- Plugin version
|
||||
|
||||
Specificity helps. "It doesn't work" doesn't. "When I click the Rook tab, I get a 403 error" does.
|
||||
|
||||
---
|
||||
|
||||
### Q: I want to contribute. Where do I start?
|
||||
|
||||
A: GitHub issues with `good first issue` label. Read the CONTRIBUTING.md in each repo. Start small.
|
||||
|
||||
We're a small team. contributions that improve things make a real difference.
|
||||
|
||||
---
|
||||
|
||||
## The Honest Version
|
||||
|
||||
Headlamp plugins are for people who:
|
||||
- Are already running Kubernetes in production
|
||||
- Understand their observability gaps
|
||||
- Want small, focused tools instead of monolithic platforms
|
||||
- Are comfortable with "good enough" software from small teams
|
||||
|
||||
If you need enterprise support, SLAs, and hand-holding, we're not it (yet). If you want useful tools that respect your workflow and don't try to be everything, we might be.
|
||||
|
||||
Try us. If we don't fit, no hard feelings. There are plenty of other dashboards. Find the one that works for your team.
|
||||
|
||||
---
|
||||
|
||||
**Last updated**: March 13, 2026
|
||||
**Audience**: Kubernetes operators, platform engineers, storage admins
|
||||
**Tone**: Honest, not salesy, specific, realistic about limitations
|
||||
|
||||
@@ -1,176 +0,0 @@
|
||||
# KubeCon EU 2026 — Response & Tactical Post Templates
|
||||
|
||||
**Status**: Ready-to-deploy. Update dates/times as conference progresses. Use if conversations align with these narratives.
|
||||
|
||||
---
|
||||
|
||||
## Pre-KubeCon (March 21-22)
|
||||
|
||||
### Template 1: The Headlamp Moment
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Trigger**: When #KubeCon hashtag begins heating up, someone mentions "dashboard" or "UI"
|
||||
|
||||
**Post**:
|
||||
if you're heading to #KubeCon and you're thinking "I wish I could see what's actually happening in my cluster without opening 6 different tools," we have 6 plugins for that.
|
||||
|
||||
see you in Amsterdam.
|
||||
|
||||
**CMO Note**: Soft sell. Positions us as understaters. Uses first-person ("we have") rather than "check out." Timing: Friday-Saturday before conference opens.
|
||||
|
||||
---
|
||||
|
||||
### Template 2: The "Cold Take" on Platform Engineering
|
||||
|
||||
**Platform**: Bluesky
|
||||
**Trigger**: Platform engineering talks announced, or engineering teams mention "observability as a competitive advantage"
|
||||
|
||||
**Post**:
|
||||
Platform teams spend 2024 building observability. They spent 2025 fighting with it. KubeCon 2026 is about finally making it *work*.
|
||||
|
||||
(Hint: Headlamp makes the "finally" part easier.)
|
||||
|
||||
**CMO Note**: Positions us as people who understand the maturity curve. Not condescending. Acknowledges that good observability is *work* not just tooling. Implies we've thought about this problem space.
|
||||
|
||||
---
|
||||
|
||||
## Main Conference (March 23-26)
|
||||
|
||||
### Template 3: The "We're Not Doing That" Take
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Trigger**: Someone tweets about "AI-powered monitoring" hype, or a vendor announces overly complex AI-observability features
|
||||
|
||||
**Post**:
|
||||
watched a demo of AI observability that required 3 new dashboards and 2 vendor contracts to set up.
|
||||
|
||||
the goal of observability is seeing what's wrong. if your tool gets in the way of that, it's not observability.
|
||||
|
||||
(we kept ours simple.)
|
||||
|
||||
**CMO Note**: Leans into Headlamp's philosophy (small, focused plugins) vs. sprawling observability stacks. Not attacking anyone. Just stating our bias. Safe because we actually *do* keep our approach simple.
|
||||
|
||||
---
|
||||
|
||||
### Template 4: Real-Time Response to "How Do You Monitor [X]"
|
||||
|
||||
**Platform**: Twitter/X (Thread)
|
||||
**Trigger**: Someone asks "how do you monitor GPU usage" or "how do you track CSI performance"
|
||||
|
||||
**Thread Option A** (GPU):
|
||||
Q: How do you monitor GPU usage in Kubernetes?
|
||||
|
||||
Short answer: You look at actual metrics. Not dashboards about dashboards. Not vendor abstractions. You look at what your hardware is actually doing.
|
||||
|
||||
Headlamp + intel-gpu plugin. See your GPU. No middleman. [link to docs]
|
||||
|
||||
**Thread Option B** (Storage):
|
||||
Q: How do you track Rook/Ceph performance?
|
||||
|
||||
Real answer: Stop thinking about monitoring as a separate system. Rook is part of your cluster. You need visibility into it from the same place you look at everything else.
|
||||
|
||||
That's the whole reason we built the Rook plugin. [link to docs]
|
||||
|
||||
**CMO Note**: These are hyperspecific. Only deploy if question arises. Shows expertise without being pushy. Links to actual docs (once we have them on GH pages).
|
||||
|
||||
---
|
||||
|
||||
### Template 5: The "We Attend Quietly" Take
|
||||
|
||||
**Platform**: Mastodon
|
||||
**Trigger**: General KubeCon reflection mid-conference (March 24-25)
|
||||
|
||||
**Post**:
|
||||
KubeCon observation: Nobody is pretending their observability stack is simple anymore. Everyone admits it's complex. The conversation has shifted from "we have visibility" to "how do we make visibility manageable."
|
||||
|
||||
We have a thesis on that. (It involves not adding more layers.)
|
||||
|
||||
**CMO Note**: Intellectual positioning. Suggests we have *design philosophy* not just tools. Mastodon audience appreciates meta-commentary about industry trends. Doesn't mention product directly until the last line.
|
||||
|
||||
---
|
||||
|
||||
## If External Events (March 21-27)
|
||||
|
||||
### Template 6: Security/Supply Chain Angle
|
||||
|
||||
**Trigger**: If a security incident, CVE, or supply chain story breaks during conference
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
[Current incident] is why we built sealed-secrets plugin.
|
||||
|
||||
Not because we think we're special. Because operators shouldn't have to choose between "use secrets" and "know where they're being stored."
|
||||
|
||||
If you're at #KubeCon, stop by and we can talk about it. [link]
|
||||
|
||||
**CMO Note**: Shows we're paying attention. Ties conference energy to our actual products. Empathetic (don't position as saviors, just problem-solvers). Only use if an actual security story breaks.
|
||||
|
||||
---
|
||||
|
||||
### Template 7: Cost Angle
|
||||
|
||||
**Trigger**: If cost/efficiency is a hot KubeCon keynote theme, or someone discusses "cost-aware monitoring"
|
||||
|
||||
**Platform**: LinkedIn
|
||||
**Post**:
|
||||
KubeCon theme observation: "Cost-aware observability" is trending because teams are finally admitting that monitoring infrastructure is expensive.
|
||||
|
||||
The plugin approach (small, focused, optional) is inherently cost-aware. You don't pay for observability you don't use.
|
||||
|
||||
This is intentional design.
|
||||
|
||||
**CMO Note**: Positions Headlamp's modular philosophy as a *feature*. Not "we're cheaper" but "we're more efficient by design." Works if cost is a main theme.
|
||||
|
||||
---
|
||||
|
||||
## Post-KubeCon (March 27+)
|
||||
|
||||
### Template 8: The Recap
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Trigger**: March 27-28, after conference ends
|
||||
|
||||
**Post**:
|
||||
KubeCon takeaway: The best tools are the ones your team forgets they're using because they just work.
|
||||
|
||||
We built Headlamp plugins like that. Small. Focused. Invisible until you need them.
|
||||
|
||||
Did we miss you in Amsterdam? [link to plugin docs]
|
||||
|
||||
**CMO Note**: Humble, unsalesy. Doesn't claim we nailed it, just states our design goal. Bridges back to self-directed learning/documentation (not aggressive marketing).
|
||||
|
||||
---
|
||||
|
||||
## General Guidelines for Day-Of Responses
|
||||
|
||||
1. **Monitor, don't dominate**: Respond to conversations, don't start them.
|
||||
2. **Listen for pain, not keywords**: "I can't see X" beats "person mentioned dashboard."
|
||||
3. **Be helpful first**: Answer questions. Mention our stuff only if relevant.
|
||||
4. **Keep it real**: If someone asks a question we don't have a good answer for, say so.
|
||||
5. **Timing**: Responses should go out within 2-4 hours of trigger, not instant (not trying too hard).
|
||||
6. **Tone check**: Every response should pass the "would an actual operator write this" test.
|
||||
|
||||
---
|
||||
|
||||
## Tools & Hashtags
|
||||
|
||||
**Primary hashtag**: #KubeCon (volume 24-26 March)
|
||||
**Secondary hashtags**: #KubeCon2026, #cloudnative, #kubernetes
|
||||
**Response hashtags**: #observability, #k8s, #platform-engineering (context-specific)
|
||||
|
||||
**Monitoring tools** (if CMO provides access):
|
||||
- Twitter search: `#KubeCon`
|
||||
- Bluesky search: `KubeCon`
|
||||
- Reddit: r/kubernetes, r/devops, r/SRE (watch for questions)
|
||||
- Slack (if we're in cloud-native Slack): #kubecon-2026
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
- These are *optional* responses, not a mandate to post daily
|
||||
- Only deploy if you believe the response is valuable (not hitting publish for metric's sake)
|
||||
- If conference energy is low or our voice doesn't fit the conversation, that's fine
|
||||
- Post-KubeCon reflection is most important; day-of is engagement sugar
|
||||
- If something unexpected breaks (security issue, major outage), escalate to CMO before responding
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
test
|
||||
Submodule
+1
Submodule org added at c420e1543f
Binary file not shown.
|
Before Width: | Height: | Size: 63 KiB |
@@ -0,0 +1,54 @@
|
||||
---
|
||||
name: coding-standards
|
||||
description: >
|
||||
Coding standards for Privileged Escalation. Covers Headlamp plugin
|
||||
development workflow, registration API, and shared libraries.
|
||||
---
|
||||
|
||||
# Coding Standards
|
||||
|
||||
## Headlamp Plugins
|
||||
|
||||
All plugins extend [Headlamp](https://headlamp.dev/docs/latest/development/plugins/getting-started), a Kubernetes dashboard with a plugin system.
|
||||
|
||||
- **Language:** TypeScript + React 18, MUI v5
|
||||
- **Scaffolding:** `npx --yes @kinvolk/headlamp-plugin create <plugin-name>`
|
||||
- **Entry point:** `src/index.tsx`
|
||||
- **Linting:** ESLint via `@headlamp-k8s/eslint-config` + Prettier
|
||||
- **Testing:** Vitest + React Testing Library
|
||||
|
||||
### Plugin Commands
|
||||
|
||||
Run from the plugin directory:
|
||||
|
||||
| Command | Purpose |
|
||||
|---|---|
|
||||
| `npm run start` | Dev mode with hot reload |
|
||||
| `npm run build` | Production build (`dist/main.js`) |
|
||||
| `npm run format` | Prettier format |
|
||||
| `npm run lint` | ESLint check |
|
||||
| `npm run lint-fix` | ESLint auto-fix |
|
||||
| `npm run tsc` | Typecheck |
|
||||
| `npm run test` | Vitest tests |
|
||||
|
||||
### Registration API
|
||||
|
||||
Import from `@kinvolk/headlamp-plugin/lib`:
|
||||
|
||||
- `registerAppBarAction()` — add components to the nav bar
|
||||
- `registerRoute()` — create new pages
|
||||
- `registerSidebarEntry()` — add sidebar items
|
||||
- `registerDetailsViewSection()` — extend resource detail views
|
||||
- `registerPluginSettings()` — add plugin configuration UI
|
||||
|
||||
### K8s API Access
|
||||
|
||||
```typescript
|
||||
import { K8s } from '@kinvolk/headlamp-plugin/lib';
|
||||
const [pods, error] = K8s.ResourceClasses.Pod.useList();
|
||||
```
|
||||
|
||||
### Shared Libraries
|
||||
|
||||
These are provided by Headlamp at runtime — **do not bundle them**:
|
||||
React, React Router, Redux, MUI, Lodash, Monaco Editor, Notistack, Iconify.
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
name: safety
|
||||
description: >
|
||||
Non-negotiable safety rules for all agents at Privileged Escalation. Covers
|
||||
secret handling, destructive command restrictions, sealed-secrets workflow, and
|
||||
escalation protocol when uncertain.
|
||||
---
|
||||
|
||||
# Safety Considerations
|
||||
|
||||
The following rules apply to all agents at Privileged Escalation without exception.
|
||||
|
||||
## Non-Negotiable Rules
|
||||
|
||||
* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Do not log, comment, or return these values in any output.
|
||||
|
||||
* **Seek Board Approval for Destructive Actions.** Destructive means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup.
|
||||
|
||||
* **No plaintext secrets in any repository.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded.
|
||||
|
||||
* **Do not use `kubectl create` in production.**
|
||||
The `privilegedescalation` namespace is Flux-managed. Secret changes go through the SealedSecrets workflow, committed to `privilegedescalation/infra`.
|
||||
|
||||
## If you are unsure
|
||||
|
||||
If you are unsure whether an action is safe, stop. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.
|
||||
@@ -0,0 +1,249 @@
|
||||
---
|
||||
name: sdlc
|
||||
description: >
|
||||
Software development lifecycle rules for Privileged Escalation. Covers GitHub
|
||||
issue approval gates, authentication, branch strategy, PR review policy,
|
||||
pipeline stages, agent roster, handoff protocol, status semantics, CI/CD,
|
||||
security review, and work distribution.
|
||||
---
|
||||
|
||||
# Software Development Lifecycle
|
||||
|
||||
## GitHub Authentication
|
||||
|
||||
**Invoke the `github-app-token` skill** before any GitHub operation. It generates a short-lived installation token and sets `GH_TOKEN`. **Never** run `gh auth login` directly — it hangs headless agents.
|
||||
|
||||
Token expires after ~1 hour. Re-invoke the skill to regenerate if needed.
|
||||
|
||||
## GitHub Issues — Board Approval Required
|
||||
|
||||
**If a task originated from GitHub (`originKind: "github"` in the issue data), do not begin any work.** Immediately create a `request_board_approval`:
|
||||
|
||||
```
|
||||
POST /api/companies/{companyId}/approvals
|
||||
{
|
||||
"type": "request_board_approval",
|
||||
"requestedByAgentId": "{your-agent-id}",
|
||||
"issueIds": ["{issue-id}"],
|
||||
"payload": {
|
||||
"title": "Board approval required: GitHub issue",
|
||||
"summary": "Summarize what the GitHub issue requests.",
|
||||
"recommendedAction": "Approve to begin work.",
|
||||
"risks": ["Work begins without board review if approved."]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Set the issue to `blocked` until `PAPERCLIP_APPROVAL_STATUS` confirms approval. Only proceed once approved.
|
||||
|
||||
## Branch Strategy
|
||||
|
||||
All plugin repositories use a single long-lived branch:
|
||||
|
||||
| Branch | Environment | Who merges |
|
||||
|--------|-------------|------------|
|
||||
| `main` | Production | CEO (Countess von Containerheim) after triple approval |
|
||||
|
||||
**Engineers always target `main` via feature branches** — never push directly.
|
||||
|
||||
Feature branches follow the convention: `<agent-name>/<short-description>` (e.g., `gandalf/add-sealed-secrets-list`).
|
||||
|
||||
## Pull Requests
|
||||
|
||||
All changes must happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — not as a reviewer.
|
||||
|
||||
```bash
|
||||
gh pr create --title "..." --body "... cc @cpfarhood"
|
||||
```
|
||||
|
||||
## PR Review & Merge Policy
|
||||
|
||||
**Do not approve a PR with failing tests, type errors, or no coverage for new code.**
|
||||
|
||||
Requires **3 approving GitHub reviews** before the CEO merges:
|
||||
|
||||
1. **UAT (Pixel Patty)** — E2E browser testing against `headlamp-dev`
|
||||
2. **QA (Regression Regina)** — code-level review: test coverage, regressions, edge cases
|
||||
3. **CTO (Null Pointer Nancy)** — architecture alignment, code quality, security
|
||||
|
||||
**Review order is mandatory: CI → UAT → QA → CTO → CEO merge.** Each stage gates the next. No agent merges their own PRs.
|
||||
|
||||
## 48-Hour PR Review SLA (Binding)
|
||||
|
||||
**MANDATORY: Every open PR must receive its first review within 48 hours of submission. No exceptions.**
|
||||
|
||||
### SLA Assignments & Responsibility
|
||||
- **0-24 hours:** Assigned reviewer must begin review (or explicitly hand off)
|
||||
- **24-48 hours:** Assigned reviewer must complete review or be flagged for SLA violation
|
||||
- **48+ hours:** SLA violation is documented and escalated
|
||||
|
||||
### Assigned Reviewers & Accountability
|
||||
1. **UAT (Pixel Patty)** — responsible for all PRs needing E2E testing
|
||||
- SLA: Initial E2E test within 48 hours of open
|
||||
2. **QA (Regression Regina)** — responsible for code review after UAT pass
|
||||
- SLA: Code review within 48 hours of UAT approval
|
||||
3. **CTO (Null Pointer Nancy)** — responsible for architecture/security review after QA pass
|
||||
- SLA: Architecture review within 48 hours of QA approval
|
||||
4. **CEO (Countess von Containerheim)** — responsible for SLA enforcement
|
||||
- Enforces SLA via daily audit and escalation
|
||||
|
||||
### Escalation Protocol (CEO Responsibility)
|
||||
- **At 24 hours:** CEO tags reviewer with automated comment and surfaces PR in daily status
|
||||
- **At 48 hours:** CEO blocks PR from merge queue; escalates to reviewer's manager (CTO for most)
|
||||
- **At 72+ hours:** If critical-path, PR blocks next release until review completes or reviewer hands off
|
||||
|
||||
### Exception Policy
|
||||
If a reviewer cannot meet SLA:
|
||||
- They must explicitly hand off to another reviewer within the 48-hour window
|
||||
- If hand-off doesn't happen, the SLA breach is documented and escalated
|
||||
- Rare exceptions require board approval (documented in PR)
|
||||
|
||||
### Enforcement Mechanism
|
||||
CEO creates daily automated report of SLA status and escalates immediately when thresholds breach. This is non-negotiable work.
|
||||
|
||||
## Pipeline
|
||||
|
||||
**Two pipelines based on change type:**
|
||||
|
||||
### Pipeline A: Plugin/Feature Changes (User-Facing Code)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
UAT: Pixel Patty validates E2E in headlamp-dev
|
||||
QA: Regression Regina reviews code quality and test coverage
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
**Applies to:** Changes in `headlamp-*-plugin/` repos (plugin code, features, bug fixes)
|
||||
|
||||
### Pipeline B: Infrastructure Changes (No UI Impact)
|
||||
```
|
||||
CI: Engineer opens PR → CI runs (lint, types, unit tests)
|
||||
QA: Regression Regina reviews code and correctness (no E2E needed)
|
||||
CTO: Null Pointer Nancy reviews architecture and security
|
||||
Merge: Countess von Containerheim merges after all approvals
|
||||
```
|
||||
|
||||
**Applies to:** Changes in `.github/workflows/`, `infra/`, `org/` repos, and template repos (CI workflows, kustomize configs, RBAC manifests, deployment scripts)
|
||||
|
||||
**Rule:** If the PR contains ONLY infrastructure changes (no plugin code changes), use Pipeline B and skip UAT. Patty's time is reserved for user-facing feature testing.
|
||||
|
||||
**Detection:** If `git diff` shows changes only in `.github/`, `infra/`, `org/`, or deployment files → Pipeline B. If any `headlamp-*-plugin/` code changed → Pipeline A.
|
||||
|
||||
### Stage 1 — Engineer Opens PR
|
||||
|
||||
1. Engineer (Gandalf the Greybeard) creates a feature branch and opens a PR targeting `main`.
|
||||
2. CI runs automatically: lint, type checks, unit tests.
|
||||
3. CI must pass before any reviewer spends tokens. If CI fails, the engineer fixes it.
|
||||
|
||||
### Stage 2 — UAT Review (Pipeline A Only)
|
||||
|
||||
4. **Pipeline A only (user-facing changes):** Pixel Patty picks up PRs with passing CI.
|
||||
5. **Pipeline B skips this:** Infrastructure PRs bypass UAT and go directly to QA.
|
||||
6. Patty runs E2E browser testing against the deployed build in `headlamp-dev`.
|
||||
7. Pass → hands off to QA. Fail → goes directly to engineer.
|
||||
|
||||
### Stage 3 — QA Review
|
||||
|
||||
7. Regression Regina picks up PRs that have passed both CI and UAT.
|
||||
8. Regina reviews: test coverage, regressions, edge cases, code quality.
|
||||
9. Pass → hands off to CTO. Fail → goes directly to engineer.
|
||||
|
||||
### Stage 4 — CTO Review
|
||||
|
||||
10. Null Pointer Nancy picks up PRs that have passed CI, UAT, and QA.
|
||||
11. Nancy reviews: architecture alignment, code quality, security.
|
||||
12. Approve → PR is ready for merge. Request changes → goes directly to engineer.
|
||||
|
||||
### Stage 5 — CEO Merge
|
||||
|
||||
13. Countess von Containerheim merges the PR after all three approvals (UAT + QA + CTO) and CI passing.
|
||||
14. Reject → returns to CTO → engineer.
|
||||
|
||||
### Hierarchy Rules
|
||||
|
||||
- CTO rejections go directly to engineer (not through QA or UAT).
|
||||
- UAT failures go directly to engineer (not through QA or UAT).
|
||||
- QA failures go directly to engineer (not through QA or UAT).
|
||||
- CEO rejections go to CTO, who cascades to engineer.
|
||||
- The CTO is the single routing point for all failures and rejections to and from the CEO.
|
||||
|
||||
## Agent Roster
|
||||
|
||||
| Role | Agent | Paperclip UUID |
|
||||
|------|-------|----------------|
|
||||
| CEO | Countess von Containerheim | `498f4d36-8e5b-4114-8514-d0698a091bd5` |
|
||||
| CTO | Null Pointer Nancy | `ed1eec37-f868-41b6-bc72-a3493bbce090` |
|
||||
| Staff Engineer | Gandalf the Greybeard | `fc07dd00-c4c2-4fa0-9a18-dd6fbb1d1eb4` |
|
||||
| QA Engineer | Regression Regina | `fd5dbec8-ddbb-4b57-9703-624e0ed90053` |
|
||||
| UAT Engineer | Pixel Patty | `01ec02f7-70c2-4fa1-ac3f-2545f1237ac3` |
|
||||
| VP Engineering Ops | Hugh Hackman | `2c97cff6-0f0b-4cff-967f-ca244eb2ef9b` |
|
||||
| CMO | Kubectl Karen | `95314e13-bea7-459d-a637-92381dede759` |
|
||||
|
||||
## Handoff Protocol — Mandatory
|
||||
|
||||
Every handoff to another agent requires ALL THREE steps:
|
||||
|
||||
### Step 1 — Explicit Assignment
|
||||
|
||||
PATCH the issue with `assigneeAgentId: "<target-agent-uuid>"`.
|
||||
@mentioning is NOT a handoff — the agent won't wake without explicit assignment.
|
||||
|
||||
### Step 2 — Status = `todo`
|
||||
|
||||
Every handoff sets `status: "todo"`. Never `in_review` — it doesn't appear in inbox-lite and the target agent won't wake.
|
||||
|
||||
### Step 3 — Release Checkout
|
||||
|
||||
```
|
||||
POST /api/issues/{issueId}/release
|
||||
Headers: Authorization: Bearer $PAPERCLIP_API_KEY, X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID
|
||||
```
|
||||
|
||||
Without this release, the receiving agent cannot checkout the issue.
|
||||
|
||||
## Status Semantics
|
||||
|
||||
| Status | Meaning |
|
||||
|--------|---------|
|
||||
| `backlog` | Not ready; parked or unscheduled |
|
||||
| `todo` | Ready and actionable; not checked out |
|
||||
| `in_progress` | Actively owned; enter by checkout only |
|
||||
| `in_review` | Self-held only; awaiting external feedback |
|
||||
| `blocked` | Cannot proceed; state blocker and who must act |
|
||||
| `done` | Complete, no follow-up remains |
|
||||
| `cancelled` | Intentionally abandoned |
|
||||
|
||||
**Never use `in_review` for handoffs.** It does not trigger inbox-lite and the receiving agent will not wake.
|
||||
|
||||
## Status Transition Rules
|
||||
|
||||
| Handoff | Correct Status |
|
||||
|---------|----------------|
|
||||
| Engineer → UAT (Patty) | `todo` |
|
||||
| UAT (Patty) → QA (Regina) | `todo` |
|
||||
| QA (Regina) → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → CEO (Countess) | `todo` |
|
||||
| Any failure → Engineer | `todo` |
|
||||
| CEO rejection → CTO (Nancy) | `todo` |
|
||||
| CTO (Nancy) → Engineer (fix) | `todo` |
|
||||
|
||||
## CI/CD
|
||||
|
||||
- CI runs on self-hosted ARC runners: `runs-on: runners-privilegedescalation`
|
||||
- Only Hugh Hackman has write access to `.github/workflows/` files
|
||||
- All CI/CD workflow changes must be delegated to Hugh
|
||||
- Runners scale to zero when idle and start automatically when a workflow triggers
|
||||
|
||||
## Security Review
|
||||
|
||||
Security review is handled as part of the CTO review stage. Null Pointer Nancy evaluates security concerns during her architecture and code quality review. There is no separate dedicated security review agent.
|
||||
|
||||
## Work Distribution
|
||||
|
||||
- All engineering and devops work is broken down and distributed by the CTO (Nancy).
|
||||
- Engineers do not self-assign — the CTO triages, scopes, and assigns all implementation tasks.
|
||||
- Hugh Hackman owns CI/CD, infrastructure, and pipeline work.
|
||||
- Gandalf the Greybeard owns plugin implementation.
|
||||
- Regression Regina owns QA review and test coverage.
|
||||
- Pixel Patty owns UAT/E2E browser testing.
|
||||
@@ -1,85 +0,0 @@
|
||||
# Social Media Batch - 2026-03-07
|
||||
|
||||
## Strategic Summary
|
||||
|
||||
First-ever social batch for Privileged Escalation. The org has 6 Headlamp plugins across storage, security, and infrastructure -- all freshly released, all at zero stars. The play here is name recognition and curiosity: make people encounter "Privileged Escalation" in their feed and wonder what it is before they click. Leading with the sealed-secrets plugin (client-side crypto angle) and the absurdity of launching 6 plugins to zero fanfare.
|
||||
|
||||
---
|
||||
|
||||
## 1. Ready to Post
|
||||
|
||||
### Post 1
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
We shipped 6 Kubernetes Headlamp plugins and nobody noticed.
|
||||
|
||||
Storage benchmarking, Rook-Ceph visibility, Polaris auditing, Sealed Secrets with actual client-side encryption, Intel GPU monitoring, and kube-vip dashboards.
|
||||
|
||||
Zero stars across the board. We are crushing it.
|
||||
|
||||
github.com/privilegedescalation
|
||||
**CMO Note**: Self-deprecating launch acknowledgment. The honesty about zero stars is the hook -- it reads as human, not corporate. Links to the org for curious clicks.
|
||||
|
||||
---
|
||||
|
||||
### Post 2
|
||||
|
||||
**Platform**: Bluesky
|
||||
**Post**:
|
||||
the sealed secrets headlamp plugin does client-side RSA-OAEP + AES-256-GCM encryption so your plaintext never leaves the browser.
|
||||
|
||||
someone forked it last month. we have our first user. or our first person who accidentally clicked fork. either way, we are celebrating.
|
||||
**CMO Note**: Technical specificity makes it credible. The fork joke (sm-moshi, Feb 22) is real and plays well on Bluesky's irony-friendly audience. Seeds curiosity about what Headlamp plugins are.
|
||||
|
||||
---
|
||||
|
||||
### Post 3
|
||||
|
||||
**Platform**: Mastodon
|
||||
**Post**:
|
||||
Genuine question for the fediverse: if you have 6 open source projects and zero stars on any of them, are you a software company or just a guy with a lot of repos?
|
||||
|
||||
Asking for a friend. The friend is github.com/privilegedescalation.
|
||||
**CMO Note**: Mastodon audience appreciates self-aware humor. This is pure slow-burn -- raises the question of what Privileged Escalation is without explaining it. The link is there for anyone curious enough to click.
|
||||
|
||||
---
|
||||
|
||||
## 2. Risky but Worth Discussing
|
||||
|
||||
### Post 4
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
Every Kubernetes UI either costs money or looks like it was designed during a mass layoff event.
|
||||
|
||||
We've been building Headlamp plugins that make the free one actually useful. Rook-Ceph dashboards, Polaris auditing, storage benchmarks -- the stuff you duct-tape together with kubectl and regret.
|
||||
|
||||
github.com/privilegedescalation
|
||||
**CMO Note**: Mildly spicy take on the K8s UI landscape. Does not name competitors directly but the implication is clear. Could rub Lens/Rancher people the wrong way. Worth discussing tone.
|
||||
|
||||
---
|
||||
|
||||
## 3. Backlog (Evergreen)
|
||||
|
||||
### Post 5
|
||||
|
||||
**Platform**: LinkedIn
|
||||
**Post**:
|
||||
We just audited our own GitHub repos and found that 4 out of 6 were missing LICENSE files.
|
||||
|
||||
They all had Apache-2.0 badges in the README. The actual license text? Not present. Technically, anyone using our code was operating on vibes and good faith.
|
||||
|
||||
Fixed now. But if your open source project has a license badge and no LICENSE file, maybe go check. We'll wait.
|
||||
**CMO Note**: Honest product personality at work. Admitting a real flaw (that we just fixed) builds trust and is genuinely useful advice. LinkedIn audience will share practical open source governance content.
|
||||
|
||||
---
|
||||
|
||||
### Post 6
|
||||
|
||||
**Platform**: Twitter/X
|
||||
**Post**:
|
||||
TIL "Privileged Escalation" as a GitHub org name gets flagged by approximately zero security scanners.
|
||||
|
||||
We checked.
|
||||
**CMO Note**: Pure name recognition play. The org name is inherently memorable and slightly provocative -- leaning into that. Short enough for easy engagement.
|
||||
@@ -1,137 +0,0 @@
|
||||
# Social Media Batch - 2026-03-10
|
||||
|
||||
## Strategic Summary
|
||||
|
||||
Six plugins. Each one exists because we had a specific problem in production with no good visibility. This batch is about "why" before "what" — explaining the actual Kubernetes pain point each plugin addresses, from our own experience. It's educational content that works pre-KubeCon: people don't need to know what Headlamp is to understand "oh, that problem sounds familiar." Also serves as support content for the KubeCon campaign dropping next week.
|
||||
|
||||
---
|
||||
|
||||
## 1. Ready to Post
|
||||
|
||||
### Post 1: Rook-Ceph Problem
|
||||
|
||||
**Platform**: Twitter/X
|
||||
|
||||
**Post**:
|
||||
You deploy Ceph because it's the right choice for distributed storage. Then you're staring at `ceph status` in a terminal wondering which pool is actually filling up, what the OSD rebalance is doing, and why your capacity projections are off by 40%.
|
||||
|
||||
We built headlamp-rook-plugin to see inside Ceph from a dashboard instead of grep-ing logs.
|
||||
|
||||
github.com/privilegedescalation
|
||||
|
||||
**CMO Note**: Opens with a relatable pain point (Ceph deployment without visibility), then delivers the specific solution (dashboards instead of CLI). No "exciting to announce" language. The problem-first framing resonates with people already running Ceph.
|
||||
|
||||
---
|
||||
|
||||
### Post 2: Sealed Secrets Problem
|
||||
|
||||
**Platform**: Bluesky
|
||||
|
||||
**Post**:
|
||||
Your team has a pattern:
|
||||
|
||||
1. Someone generates a secret
|
||||
2. They echo it in Slack "here's the password"
|
||||
3. It's in the channel history forever
|
||||
4. Someone rotates it, forgets to tell the database
|
||||
5. 2am incident
|
||||
|
||||
We built headlamp-sealed-secrets-plugin so the secret never leaves the browser and stays encrypted in your cluster. The plaintext never transits anywhere someone can screenshot it.
|
||||
|
||||
**CMO Note**: Captures the actual workflow failure that sealed-secrets solves. The numbering of the failure pattern is specific and darkly funny. Bluesky audience appreciates the "this is how we actually mess up" honesty.
|
||||
|
||||
---
|
||||
|
||||
### Post 3: Polaris Problem
|
||||
|
||||
**Platform**: Mastodon
|
||||
|
||||
**Post**:
|
||||
Kubernetes best practices are things you know about the week after you've already deployed your application with none of them.
|
||||
|
||||
Polaris audits your workloads against security and reliability policies. It shows you what you're doing wrong before it becomes a 3am outage.
|
||||
|
||||
We built the headlamp-polaris-plugin so you can actually see the audit results in your dashboard instead of waiting for the automated security scan email you never read.
|
||||
|
||||
**CMO Note**: Self-aware about human nature (learning best practices after deployment fails). Polaris is the solution. Mastodon audience gets the candor. Not preachy, just practical.
|
||||
|
||||
---
|
||||
|
||||
### Post 4: Intel GPU Problem
|
||||
|
||||
**Platform**: Twitter/X
|
||||
|
||||
**Post**:
|
||||
You provisioned Intel GPUs in your K8s cluster for ML workloads. Cool.
|
||||
|
||||
Now: which node has available GPU? How hot are they running? Is the scheduler actually placing workloads on GPU nodes or just on CPU? Is anything actually using them?
|
||||
|
||||
We built headlamp-intel-gpu-plugin to answer those questions from a dashboard instead of kernel logs.
|
||||
|
||||
github.com/privilegedescalation
|
||||
|
||||
**CMO Note**: Chains questions that GPU cluster operators actually have. Each question hints at a real visibility gap. The solution (dashboard instead of logs) is matter-of-fact. Specific pain point without corporate language.
|
||||
|
||||
---
|
||||
|
||||
### Post 5: TrueNAS CSI Problem
|
||||
|
||||
**Platform**: Bluesky
|
||||
|
||||
**Post**:
|
||||
Your storage driver is configured. Your benchmark says it can do 10k IOPS.
|
||||
|
||||
But what's actually happening in production? You're scheduling workloads, moving data around, and your I/O profile looks nothing like the benchmark.
|
||||
|
||||
We built headlamp-tns-csi-plugin so you can see kbench storage metrics live in your cluster dashboard. No "apply a manifest and wait for email," just see what your storage is actually doing.
|
||||
|
||||
**CMO Note**: Contrasts lab conditions (benchmark) with production reality (actual I/O profile). Storage visibility without waiting. Appeal to operators frustrated with "set it and hope" storage management.
|
||||
|
||||
---
|
||||
|
||||
### Post 6: kube-vip Problem
|
||||
|
||||
**Platform**: Twitter/X
|
||||
|
||||
**Post**:
|
||||
You've got a load balancer. You've got virtual IPs floating around your cluster. And someone's asking "which service is that IP mapped to?"
|
||||
|
||||
Now what? Grep the config? Check the VirtualIP manifest? It's 2025 and you're hunting through YAML.
|
||||
|
||||
We built headlamp-kube-vip-plugin so virtual IPs and load balancer status show up in your dashboard where you can actually see them.
|
||||
|
||||
github.com/privilegedescalation
|
||||
|
||||
**CMO Note**: Specific frustration: answering "which service" requires config hunting. The solution is dashboard visibility. Dry tone emphasizing the absurdity of 2025-era manual lookups.
|
||||
|
||||
---
|
||||
|
||||
## 2. Risky but Worth Discussing
|
||||
|
||||
### Post 7: Meta Comment (Optional)
|
||||
|
||||
**Platform**: Twitter/X
|
||||
|
||||
**Post**:
|
||||
Six Kubernetes plugins, and the common thread isn't "advanced observability" or "enterprise features."
|
||||
|
||||
It's: we had a problem. The CLI wasn't good enough. The logs were hard to parse. So we built a dashboard for it.
|
||||
|
||||
Sometimes the answer to "why do we exist" is "we got frustrated with grep."
|
||||
|
||||
**CMO Note**: Self-aware meta-commentary on why all six plugins exist. The "we got frustrated with grep" line is the voice we're known for. Could feel slightly salty to some, but earns credibility with operators who've been there. Optional amplification of the whole batch theme.
|
||||
|
||||
---
|
||||
|
||||
## 3. Backlog (Evergreen)
|
||||
|
||||
None for this batch — these posts work best as a thematic set posted over 3-5 days while driving toward KubeCon, then are less relevant after.
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
- Suggested posting schedule: 1 post per day starting tomorrow (March 11), finishing by March 15, giving time for engagement before KubeCon campaign drops March 21
|
||||
- Each post stands alone but builds narrative collectively
|
||||
- Educational angle differentiates from release announcements and provides value even for non-adopters
|
||||
- Heavy on problem framing, light on pitch — fits the voice and builds trust
|
||||
Reference in New Issue
Block a user