Subhanshu Mohan GuptaDevSecOps, platform engineering and cloud security. Long-form essays on the infrastructure that survives production.https://subhanshumg.com/2026-08-24T21:26:10.000ZSubhanshu Mohan Guptasubhanshugupta0@gmail.comYour rate limiter was designed for humanshttps://blogs.subhanshumg.com/your-rate-limiter-was-designed-for-humans2026-08-24T21:26:10.000Z2026-08-24T21:26:10.000ZAgent traffic does not get tired. Four layers of your stack assume it does.Prefill Is Compute, Decode Is Memory: The Architecture Shift Nobody Budgeted Forhttps://subhanshumg.com/blogs/prefill-is-compute-decode-is-memory2026-06-26T00:00:00.000Z2026-06-26T00:00:00.000ZEvery LLM request is two workloads with opposite appetites running on one chip. In 2025 the industry quietly stopped sharing the silicon. Here is the architecture, the economics, and the threshold where it pays.The Data Plane Is the New Perimeterhttps://subhanshumg.com/blogs/the-data-plane-is-the-new-perimeter2026-06-08T00:00:00.000Z2026-06-08T00:00:00.000ZA reference architecture for AI-native data security: making security a property of the platform, not a feature of the app.Trust the Silicon. They Said.https://blogs.subhanshumg.com/teefail-broke-confidential-compute2026-05-24T22:34:35.416Z2026-05-24T22:34:35.416ZTEE.Fail did not kill confidential compute. It narrowed it. The threat model that excluded physical access stayed safe; the threat model that included it did not. Slatewatch Cyber rebuilt its workloadThe EU CRA countdownhttps://blogs.subhanshumg.com/the-eu-cra-countdown2026-05-20T08:37:36.830Z2026-05-20T08:37:36.830ZEvery product with digital elements sold in the EU after December 2027 must carry a CE conformity assessment.
That is the EU CRA. The scope is broader than GDPR. The documentation trail is non-trivialCrypto inventory: the platform workstream nobody scopedhttps://blogs.subhanshumg.com/crypto-inventory-the-platform-workstream-nobody-scoped2026-05-15T09:06:52.737Z2026-05-15T09:06:52.737ZIronway Materials ran a crypto audit in 2024 and shipped two years of new TLS code on top of it. The 2026 audit found seventeen new libraries, three of them in the hot path, all of them invisible to tThe agentic SOC is herehttps://blogs.subhanshumg.com/the-agentic-soc-is-here2026-05-11T10:38:26.907Z2026-05-11T10:38:26.907ZThree vendor agentic-SOC platforms in Q1 2026. One platform-engineering charter that decides whether they work.
Microsoft Sentinel AI shipped. Splunk Agentic SOC launched at RSAC. Google SecOps and TThe distributed monolith taxhttps://blogs.subhanshumg.com/the-distributed-monolith-tax2026-05-06T03:17:08.047Z2026-05-06T03:17:08.047ZWe collapsed 47 microservices to 8. Deploy time went up, latency went down, and on-call went silent. Here's what the microservices evangelists didn't tell you about Dunbar's number for services.
MShort-lived OIDC for CI: kill every long-lived GitHub Actions tokenhttps://blogs.subhanshumg.com/short-lived-oidc2026-05-03T05:31:09.663Z2026-05-03T05:31:09.663ZGitHub OIDC to AWS/GCP/Azure federated credentials killed the need for long-lived PATs in CI. Most orgs still have PATs in use in 2026. Short-lived OIDC is the one-day win.
Narrative arc
The PAT failuThe 50ms lie: when edge AI actually matters (and when you're paying Cloudflare for marketing)https://blogs.subhanshumg.com/the-50ms-lie2026-04-20T17:25:57.196Z2026-04-20T17:25:57.196ZCloudflare and Fly.io are selling 50ms of latency savings on a 5,000ms inference like it's a revolution. That's 1% of the total latency. You're optimizing the rounding error while paying a 10x penaltyStop building agents like prompts. Build them like state machines.https://blogs.subhanshumg.com/stop-building-agents-like-prompts-build-them-like-state-machines2026-04-19T09:48:30.850Z2026-04-19T09:48:30.850ZGithub repo: https://github.com/SubhanshuMG/agents-as-state-machines
The thesis in one paragraph
Stop calling them agents. They are state machines that invoke LLMs at certain transitions. The multi-aHow I Built ForgeKit: An Open-Source Engineering Acceleration Platform That Scaffolds Production-Ready Projects in Under 60 Secondshttps://blogs.subhanshumg.com/forgekit2026-03-24T16:30:51.167Z2026-03-24T16:30:51.167Zhttps://github.com/SubhanshuMG/ForgeKit
The Problem Nobody Talks About Honestly
It is 9 AM on a Monday. Your team just got greenlit on a new microservice. You spin up a fresh repo and then spend theBuilding a Deployment Health Validatorhttps://blogs.subhanshumg.com/building-a-deployment-health-validator2026-03-10T19:52:12.677Z2026-03-10T19:52:12.677ZA deep-dive into microservice health checking, topological startup ordering and why HTTP 200 does not mean a service is healthy.
The Incident
Picture this: your on-call rotation fires a PagerDuty alePlatform Engineering at the Edgehttps://blogs.subhanshumg.com/platform-engineering-at-the-edge2026-03-03T10:30:39.873Z2026-03-03T10:30:39.873ZNo Internal Developer Platform today supports disconnected edge environments. Backstage, Port, and Cortex all assume always-on cloud connectivity, yet organizations like GE HealthCare (100+ hospital-eGoverning the Ungovernable: Building an EU AI Act Article 9 Compliance Framework for Agentic AI That Actually Works in Productionhttps://blogs.subhanshumg.com/governing-the-ungovernable2026-02-28T07:04:29.354Z2026-02-28T07:04:29.354ZThe EU AI Act's risk management requirements for high-risk AI systems are now on the clock. August 2, 2026 is the hard deadline for Annex III systems. But nobody has published a practical technical imThe 3AM Problem: Why On-Call Burnout Is a System Design Failure, Not a People Problemhttps://blogs.subhanshumg.com/the-3am-problem-why-on-call-burnout-is-a-system-design-failure-not-a-people-problem2026-02-25T10:04:36.956Z2026-02-25T10:04:36.956ZThe Human Story Behind the Pager
Meet Priya. Senior backend engineer with 5 years of experience, joined a fintech scale-up to build payment infrastructure. She is good at her job.
Then she went on-calThe $4.45M Mistake: How a Missing SBOM Requirement Let the XZ Utils Backdoor Slip Past Millions of Servershttps://blogs.subhanshumg.com/xz-utils-backdoor-sbom-supply-chain-security2026-02-22T15:05:20.714Z2026-02-22T15:05:20.714ZThe XZ Utils backdoor (CVE-2024-3094) nearly became the most devastating supply chain attack in history; a patient, three-year social engineering campaign that embedded a remote code execution backdooThe Global Cloud Blackouthttps://blogs.subhanshumg.com/the-global-cloud-blackout2026-02-17T13:51:01.278Z2026-02-17T13:51:01.278ZIf AWS disappeared tomorrow, would your company survive?
Not degraded. Not slow. Gone.
Most "highly available" systems would collapse within hours. This isn't fear-mongering. It's an architectural reHow Attackers Bypass Your “Compliant” CI/CD Pipeline (And How to Redesign It)https://blogs.subhanshumg.com/how-attackers-bypass-your-compliant-cicd-pipeline-and-how-to-redesign-it2026-02-08T23:43:21.588Z2026-02-08T23:43:21.588ZModern CI/CD pipelines are often treated as untouchable “trusted builds” – locked down by code review and best practices but that trust is a myth. A pipeline is a prime attack surface, containing everThe $0 Compliance Stackhttps://blogs.subhanshumg.com/the-zero-dollar-compliance-stack2026-01-26T20:38:25.885Z2026-01-26T20:38:25.885ZThe Lie We’re All Sold
“You need expensive GRC tools to pass enterprise audits.”
Reality:
Auditors don’t care about tools
They care about controls, traceability and evidence
Compliance ≠ SoftwarSecrets are a Supply Chainhttps://blogs.subhanshumg.com/secrets-are-a-supply-chain2026-01-23T14:32:43.990Z2026-01-23T14:32:43.990ZEveryone rotates secrets.
Very few design secret lifecycle risk and that gap is where breaches live.
Most organizations believe secret rotation equals security. It doesn’t.
Rotation is a maintenance Designing an ISO-27001-Native CI/CD Pipeline on AWShttps://blogs.subhanshumg.com/iso-270012026-01-21T08:20:08.740Z2026-01-21T08:20:08.740Z“We passed an ISO-27001 surveillance audit with zero Jira tickets, zero screenshots, and zero manual evidence.”
That line usually gets silence. Then disbelief. Then the real question:
“Okay… how?”
Beyond the Kernelhttps://blogs.subhanshumg.com/beyond-the-kernel2025-11-09T17:00:42.993Z2025-11-09T17:00:42.993ZSecurity no longer lives outside the system. It lives within the kernel.
In a world of microservices, containers, and ephemeral workloads, traditional observability tools see only what applications exDevSecOps for the Mindhttps://blogs.subhanshumg.com/devsecops-for-the-mind2025-08-31T19:26:40.150Z2025-08-31T19:26:40.150ZIntroduction
Developers build systems. DevSecOps engineers build secure, automated pipelines.But what happens when you apply the same principles to your own life and knowledge?
Over the last year, I’vDeploying a Bitcoin Regtest Network with Docker and CI/CD Toolshttps://blogs.subhanshumg.com/deploying-a-bitcoin-regtest-network-with-docker-and-cicd-tools2025-08-23T08:17:11.286Z2025-08-23T08:17:11.286ZHands-on + R&D guide.
We’ll stand up a private Bitcoin regtest network with two nodes, peer them, mine spendable coins and send/confirm transactions; wrapped in a clean repo with CI and an optional deThe Ultimate GitLab Import/Export Toolkit for Engineershttps://blogs.subhanshumg.com/gitlab-import-export-toolkit2025-07-30T21:30:09.997Z2025-07-30T21:30:09.997Z“I’m a DevOps engineer - if I’m doing it manually twice, I’m writing a script.”
A few weeks ago, I was handed a deceptively simple‑sounding task: spin up an entire playground environment, pipelines,Integrating RASP with CI/CD for Automated Vulnerability Responsehttps://blogs.subhanshumg.com/rasp-integration2025-06-24T06:53:34.156Z2025-06-24T06:53:34.156ZIntroduction
Runtime Application Self-Protection (RASP) embeds security within running applications and can report attacks in real-time. By integrating RASP into CI/CD pipelines, production threat intMastering Traefik as a Dynamic Reverse Proxy for Containerized Environmentshttps://blogs.subhanshumg.com/mastering-traefik-as-a-dynamic-reverse-proxy-for-containerized-environments2025-05-18T22:28:48.818Z2025-05-18T22:28:48.818ZIntroduction
In modern microservices and containerized ecosystems, Traefik serves as a powerful reverse proxy, offering dynamic service discovery, advanced routing capabilities and automated SSL/TLS mBuilding Agentic RAG Systems: DevSecOps Blueprint for Autonomous & Secure AIhttps://blogs.subhanshumg.com/building-agentic-rag-systems-devsecops-blueprint-for-autonomous-and-secure-ai2025-04-22T23:39:23.505Z2025-04-22T23:39:23.505ZIntroduction: Why Agentic RAG is the Next Frontier
Retrieval-Augmented Generation (RAG) revolutionized LLMs by grounding them in external data. But static, one-shot retrieval struggles with dynamic, mEnd-to-End Cloud-Native Deploymenthttps://blogs.subhanshumg.com/end-to-end-cloud-native-deployment2025-04-15T21:22:03.456Z2025-04-15T21:22:03.456ZIntroduction
This technical walkthrough demonstrates how to deploy a secure, scalable microservice on AWS using infrastructure-as-code (Terraform), containerization (Docker), and serverless computing Caching Conundrum: Is There Truly Just One Path to API Efficiency?https://blogs.subhanshumg.com/caching-conundrum2025-04-14T16:21:15.463Z2025-04-14T16:21:15.463ZCaching involves storing duplicates of frequently accessed data at various points along the request-response path.
When a consumer seeks a resource like a YouTube video, the request traverses one or mMicro-Segmentation Strategies in DevSecOpshttps://blogs.subhanshumg.com/micro-segmentation-strategies-in-devsecops2025-03-23T14:42:10.126Z2025-03-23T14:42:10.126ZIntroduction
Traditional perimeter security is no longer sufficient in today’s dynamic and threat-laden IT environments. Micro-segmentation: The process of dividing your network into granular zones enDesigning Scalable, Secure Systems w/ DevSecOpshttps://blogs.subhanshumg.com/designing-scalable-secure-systems-w-devsecops2025-03-02T21:22:03.282Z2025-03-02T21:22:03.282ZIn the fast-evolving landscape of modern application development, building scalable, high-performance systems demands more than just robust code it calls for a thoughtful blend of system design, operaUnikernel Containershttps://blogs.subhanshumg.com/unikernel-containers2025-01-28T11:39:40.716Z2025-01-28T11:39:40.716ZIntroduction
In a rapidly evolving technological landscape, where agility and security are paramount, unikernel containers are emerging as a revolutionary force in DevSecOps. These ultra-lightweight cThe Power of Rootless Docker Containershttps://blogs.subhanshumg.com/the-power-of-rootless-docker-containers2025-01-20T19:40:23.737Z2025-01-20T19:40:23.737ZIn the rapidly evolving world of DevSecOps, ensuring secure deployments is more critical than ever. Enter Docker rootless containers, a groundbreaking solution designed to enhance container security bContainer Networking Security with Traefikhttps://blogs.subhanshumg.com/container-networking-security-with-traefik2025-01-16T13:49:55.144Z2025-01-16T13:49:55.144ZIntroduction
Container networking security is a cornerstone of modern microservices architecture. Tools like Traefik and Docker Compose simplify orchestration and networking, but implementing advancedServerless 2.0: Hybrid Decentralized Frameworks for Stateless Computehttps://blogs.subhanshumg.com/serverless-20-hybrid-decentralized-frameworks-for-stateless-compute2025-01-02T10:40:14.040Z2025-01-02T10:40:14.040ZIntroduction
In the age of cloud computing, serverless architectures have become synonymous with scalability, cost-efficiency, and operational simplicity. However, these advantages often come with a cThe Future of DevSecOpshttps://blogs.subhanshumg.com/the-future-of-devsecops2024-12-21T15:50:37.644Z2024-12-21T15:50:37.644ZIn today’s hyper-connected world, building software often involves diverse, distributed teams collaborating across multiple organizations. Traditional DevSecOps pipelines rely on centralized tools andStreamlining Node Operator Docker Images with Automated Rolling Updateshttps://blogs.subhanshumg.com/architecture-design-for-automated-rolling-updates-of-node-operator-docker-images2024-12-10T06:13:41.248Z2024-12-10T06:13:41.248ZComponents
Docker Registry Monitoring:
Uses a webhook or polling mechanism to detect new releases of the bitscrunch:latest image.
Integrates with a CI/CD pipeline to automate the update process.
AEnsuring Inter-Agent Data Integrity in Multi-Node DevSecOpshttps://blogs.subhanshumg.com/ensuring-inter-agent-data-integrity-in-multi-node-devsecops2024-11-30T08:30:03.233Z2024-11-30T08:30:03.233ZIntroduction
In modern DevSecOps environments, where distributed systems and multi-node architectures are prevalent, ensuring data integrity during inter-agent communication is crucial. Compromised daFederated Learning for Distributed MLOps Securityhttps://blogs.subhanshumg.com/federated-learning-for-distributed-mlops-security2024-11-17T00:52:04.027Z2024-11-17T00:52:04.027ZIntroduction
As Machine Learning Operations (MLOps) scale across industries, safeguarding sensitive data while enabling distributed training becomes a significant challenge. Enter Federated Learning (Accelerating Deployment Velocity: Reducing Build Times and Image Sizes in Kuberneteshttps://blogs.subhanshumg.com/accelerating-deployment-velocity-reducing-build-times-and-image-sizes-in-kubernetes2024-10-29T04:22:09.879Z2024-10-29T04:22:09.879ZIntroduction
Welcome to the final part of my Kubernetes CI/CD optimization series!So far, we’ve covered the essentials of Kubernetes deployment, container image optimization, and strategies for speediSecuring Kubernetes Operations with Runtime Security Best Practiceshttps://blogs.subhanshumg.com/securing-kubernetes-operations-with-runtime-security-best-practices2024-10-22T03:46:21.583Z2024-10-22T03:46:21.583ZWelcome to the 9th installment of my Kubernetes series wherw we’ll dive into advanced runtime security techniques for Kubernetes environments to detect anomalies, enforce strict container security polPicking the Right Load Balancer for Your Kubernetes Environmenthttps://blogs.subhanshumg.com/picking-the-right-load-balancer-for-your-kubernetes-environment2024-10-17T16:50:08.461Z2024-10-17T16:50:08.461ZIntroduction
As Kubernetes adoption skyrockets, managing traffic within and to your clusters becomes a critical aspect of ensuring availability, performance, and scalability. One of the most importantDesigning an Effective Fallback Plan for Kubernetes Failureshttps://blogs.subhanshumg.com/designing-an-effective-fallback-plan-for-kubernetes-failures2024-10-10T19:42:38.492Z2024-10-10T19:42:38.492ZWelcome to Part VII of my Kubernetes series, where we’ll explore the essential strategies for building a robust disaster recovery and fallback plan for your Kubernetes workloads. In this article we'llLeveraging Caching, CDN, and Rate Limiting to Enhance Kubernetes Performancehttps://blogs.subhanshumg.com/leveraging-caching-cdn-and-rate-limiting-to-enhance-kubernetes-performance2024-10-06T19:29:21.548Z2024-10-06T19:29:21.548ZWelcome to Part VI of my Kubernetes series! In this post, we’re diving deep into three powerful techniques: caching, Content Delivery Networks (CDNs), and rate limiting that can significantly boost thUnderstanding Composite SLA Calculations in Kubernetes Systemshttps://blogs.subhanshumg.com/understanding-composite-sla-calculations-in-kubernetes-systems2024-10-04T18:35:14.087Z2024-10-04T18:35:14.087ZWelcome to Part V of my Kubernetes series! In this installment, we’re going to explore the complex yet crucial process of calculating the Composite Service Level Agreement (SLA) for distributed applicEnsuring PCI-DSS, POPI, GDPR, and HIPAA Compliance in Kubernetes Systemshttps://blogs.subhanshumg.com/ensuring-pci-dss-popi-gdpr-and-hipaa-compliance-in-kubernetes-systems2024-10-02T15:52:18.813Z2024-10-02T15:52:18.813ZIntroduction
Welcome to Part IV of my Kubernetes series, where we delve into building compliant systems on Kubernetes to meet stringent regulatory standards such as PCI-DSS, POPI, GDPR, and HIPAA. As Optimizing Costs for Cloud Architectures with Kubernetes Workloadshttps://blogs.subhanshumg.com/optimizing-costs-for-cloud-architectures-with-kubernetes-workloads2024-09-30T17:05:40.875Z2024-09-30T17:05:40.875ZIn this III part of my Kubernetes series, we will dive deep into Cost Estimation for Cloud Architectures, focusing on practical strategies for managing the cost of running Kubernetes workloads in clouTweaking Kubernetes Deployments for Enhanced Backward Compatibilityhttps://blogs.subhanshumg.com/tweaking-kubernetes-deployments-for-enhanced-backward-compatibility2024-09-29T15:46:28.195Z2024-09-29T15:46:28.195ZWelcome to Part II of my Kubernetes series, where we explore how to Master Kubernetes Deployments for Seamless Backward Compatibility. Managing Kubernetes upgrades can be tricky, especially when you n