Part two of replacing every stored credential in my home cluster. Flux reads its configuration from a registry instead of GitHub, the trust conditions do the real work, one key is left, and the cluster survives the cloud being down.
My home Kubernetes cluster used to run on long-lived keys, copied into more places than I could list. Part one: the idea that replaced them, and how the cluster now pulls its images as the pod that needs them, without a stored credential.
Kafka's log is immutable and replicated everywhere; GDPR demands you make a user's data unreachable on request. Per-user DEKs in Postgres, an Avro envelope on the wire, and crypto-shredding gets you both — without ever mutating Kafka.