blog

notes from the field.

release notes with the limits named, operator stories from EKS shops that banned long-lived AWS creds, and the occasional honest “what didn't work” post-mortem. cross-posted to github discussions for the longer reads.

June 9, 2026 · 11 min
`whoami` says `ssm-user`, CloudTrail says you: browser shells into EKS nodes, no SSH
Periscope v1.1.6 opens a terminal onto an EKS node's EC2 host from the dashboard, with no SSH key, no bastion, and no inbound ports. The session runs under the operator's own short-lived AWS credentials, minted from their OIDC id_token, so the Periscope pod holds zero SSM permissions and CloudTrail attributes every session to a human. Notes on the transport, the spike that proved it, and the three IAM gotchas that nearly sank it.
by @gnana997
read →
May 31, 2026 · 8 min
Four tenants, one GPU, one number: where attribution breaks under MPS
Once an NVIDIA GPU is shared across multiple pods via MPS, the standard Kubernetes GPU telemetry stack stops telling the truth about who is using it. Lab notes on the misattribution, the mechanism behind it, and what a Kubernetes GPU view has to do to stay honest, captured on a laptop GPU with no cloud spend.
by @gnana997
read →
May 23, 2026 · 7 min
Five subsystems, one GPU: the join Periscope Milestone 2 has to make
GPU visibility in Kubernetes is not one metric — it's a join across allocation, telemetry, node description, workload identity, and operator intent. Lab notes from prepping Periscope Milestone 2: the boundaries that matter, the one that doesn't fully close, and what a real operator-question view requires that a Grafana dashboard alone doesn't deliver.
by @gnana997
read →
May 16, 2026 · 8 min
What can this pod do in AWS? A surprisingly hard question in EKS.
Which pods use this IAM role? What does this pod actually grant in AWS? Periscope v1.1's three new EKS identity surfaces answer the questions you get paged for — in seconds.
by @gnana997
read →
May 8, 2026 · 10 min
Every audit row says `alice@corp`, not `periscope-bot` — here's how
How Periscope makes every K8s call carry the human's identity: per-user impersonation, the SAR pre-flight pattern, the three authorization modes, and how the same shape survives the agent-backed cluster path.
by @gnana997
read →

notes from the field.

`whoami` says `ssm-user`, CloudTrail says you: browser shells into EKS nodes, no SSH

Four tenants, one GPU, one number: where attribution breaks under MPS

Five subsystems, one GPU: the join Periscope Milestone 2 has to make

What can this pod do in AWS? A surprisingly hard question in EKS.

Every audit row says `alice@corp`, not `periscope-bot` — here's how