Before a chat-driven kubectl change gets silently reverted — a measured selfHeal revert in about six seconds, detecting ArgoCD-managed resources from tracking-id and instance labels, warn-then-allow approval cards, the real scope of a cluster-admin connection role, and the read-only views built on Application resources.
Isolating other people’s code on a shared EKS hosting cluster — why gVisor over plain containers, Fargate or per-team nodes, why Cilium replaces the default VPC CNI while the cluster is still empty, how the node bootstrap installs a pinned and checksummed gVisor that fails closed, the missing gvisor-bin directory that broke the first apply, and the app domain and __Host- cookie that keep user apps away from the dashboard.
Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.
What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.
Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.
Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.
How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.