AI Platform Architect
Ashish Kumar Pandey
Building next-gen platforms for the AI and agentic future. I design and run cloud-native platforms across telecom, edtech, and healthtech. This site is where I write about that work.
Latest essays
Where Kubernetes security config actually lives
A map of the files and objects you will open when Trivy, Falco, PSS, AppArmor, and the API server are misbehaving.
Watch the cluster at runtime with Falco
Falco sits on syscalls and Kubernetes audit events. Custom rules go in falco_rules.local.yaml. Restart, then prove the rule fires.
Sandbox runtimes and CIS checks: gVisor, Kata, kube-bench
RuntimeClass to pick gVisor or Kata for a workload, and kube-bench to score the node against CIS Kubernetes.
AppArmor and seccomp on Kubernetes
Kernel-level restrictions for pods: load an AppArmor profile on the node, point seccomp at RuntimeDefault or a localhost JSON, then test the deny.
Pod Security Standards and Gatekeeper
Namespace labels for PSS, what restricted actually requires, and how Gatekeeper ConstraintTemplates sit on top of admission.
Focus
- AWS
- Kubernetes
- Terraform
- ArgoCD
- OpenTelemetry
- MLflow
- Python