https://kukie.tech/series/kukie-infra/Recent content in Kukie Infra on HistoryHugoko-krThu, 22 Oct 2026 21:00:00 +0900https://kukie.tech/posts/kukie-infra-11/Thu, 22 Oct 2026 21:00:00 +0900https://kukie.tech/posts/kukie-infra-11/Three days after the self-hosted runner went live, the weak point it shipped with turned into an incident — terraform apply moved to a throwaway CodeBuild runner, a leftover review buffer re-posted one PR’s comment into later reviews, the fix that gives every job its own container with a registration token minted by a GitHub App, Claude Code baked into the image after the installer started returning 429, and the docker.sock risk that is still left.https://kukie.tech/posts/kukie-infra-10/Thu, 22 Oct 2026 09:00:00 +0900https://kukie.tech/posts/kukie-infra-10/Isolating other people’s code on a shared EKS hosting cluster — why gVisor over plain containers, Fargate or per-team nodes, why Cilium replaces the default VPC CNI while the cluster is still empty, how the node bootstrap installs a pinned and checksummed gVisor that fails closed, the missing gvisor-bin directory that broke the first apply, and the app domain and __Host- cookie that keep user apps away from the dashboard.https://kukie.tech/posts/kukie-infra-09/Mon, 19 Oct 2026 19:00:00 +0900https://kukie.tech/posts/kukie-infra-09/Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.https://kukie.tech/posts/kukie-infra-08/Mon, 19 Oct 2026 15:00:00 +0900https://kukie.tech/posts/kukie-infra-08/Removing the step where customers type their AWS account number — a CloudFormation custom resource that mails the role ARN to an SNS topic, an SQS buffer, a server that treats the notice as a hint and proves it by assuming the role, and the replies, retries and open-mailbox risks that come with it.https://kukie.tech/posts/kukie-infra-07/Mon, 19 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-07/Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.https://kukie.tech/posts/kukie-infra-06/Fri, 16 Oct 2026 13:00:00 +0900https://kukie.tech/posts/kukie-infra-06/Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.https://kukie.tech/posts/kukie-infra-05/Thu, 15 Oct 2026 16:00:00 +0900https://kukie.tech/posts/kukie-infra-05/What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.https://kukie.tech/posts/kukie-infra-04/Wed, 14 Oct 2026 09:30:00 +0900https://kukie.tech/posts/kukie-infra-04/How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.https://kukie.tech/posts/kukie-infra-03/Wed, 14 Oct 2026 09:20:00 +0900https://kukie.tech/posts/kukie-infra-03/Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.https://kukie.tech/posts/kukie-infra-02/Wed, 14 Oct 2026 09:10:00 +0900https://kukie.tech/posts/kukie-infra-02/Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.https://kukie.tech/posts/kukie-infra-01/Wed, 14 Oct 2026 09:00:00 +0900https://kukie.tech/posts/kukie-infra-01/How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.