AI Agent Audit Trail: What to Log for Every Tool Call
What an AI agent audit trail must record for each tool call: identity, policy version, verdict, approval, arguments digest, outcome, cost, trace IDs.
Guides
Secure AI infrastructure on Kubernetes.
Comparisons and checklists for GPU admission, MCP security, LLM observability, and serving stacks — written from production platform work.
01
Topic hubs
Topic hubs.
02
Library
All guides.
Practical guides on GPU schedulers, MCP and agent security, LLM vs MCP gateways, inference budgets, Argo CD vs Flux, vLLM autoscaling with KEDA, and KServe versus vLLM.
Argo CD vs Flux in 2026: a hands-on comparison
Argo CD vs Flux on Kubernetes: reconciliation models, Application vs HelmRelease, self-heal and prune, plus kind lab timings from a public duel repo.
Inference Budget Guard: token budgets before the GPU
Per-team inference budgets on the gateway path: reserve estimated cost before chat completion, settle after, fail closed. Status from ai-runtime-platform.
KServe vs vLLM: Engine, Platform, or Both?
KServe and vLLM solve different layers of LLM serving on Kubernetes. What each does, how KServe runs vLLM, and when a plain vLLM Deployment is enough.
Kueue vs Volcano vs KAI Scheduler for GPU Workloads
How Kueue, Volcano and NVIDIA KAI Scheduler differ for GPU inference and training on Kubernetes: architecture, queues, quotas and when to pick which.
LLM Gateway vs MCP Gateway: boundaries and policies
LLM gateways govern model traffic; MCP gates control tool calls. Different boundaries and policies, with files from ai-runtime-platform and ASC.
MCP Security Checklist for Kubernetes
A practical MCP security checklist for agents on Kubernetes: identity, token audience, tool pinning, egress, sandboxing, approvals and audit evidence.
OpenTelemetry LLM Observability: GenAI Conventions & vLLM
Practical OpenTelemetry for LLMs: GenAI semantic conventions, token usage metrics, vLLM Prometheus metrics and a token cost pipeline on Kubernetes.
OWASP Agentic Top 10 Mapped to Kubernetes Controls
Each risk in the OWASP Top 10 for Agentic Applications mapped to Kubernetes controls you can enforce: identity, admission, egress, sandboxing, audit.
Autoscaling vLLM with KEDA: queue depth signals
Scale vLLM on Kubernetes with KEDA on Prometheus queue metrics: ScaledObject shape, vllm:num_requests_waiting, and how this relates to KServe autoscaling.
Available for meaningful infrastructure conversations