Hangar

Architecture · Opinions, with receipts

Where I stand, and why

The principles say what I believe in general. These essays are narrower and sharper: one question each, the answer I'd give if you asked me across a table, and the evidence from Hangar behind it, including the parts that didn't go well.

  1. November 1, 2026 · 15 min read

    A CI/CD engine you can call

    In one week Glidepath grew an API: 30 operations for runs, logs, evidence, tests, releases and events, decided by the cluster's own identity and RBAC, measured with SLOs and traces, and now open to people over a Gateway route. Why a CI/CD engine should be an API and not a portal's backend, how Tower moved onto it one piece at a time without a flag day, and what it still doesn't do.
  2. October 27, 2026 · 13 min read

    The release record, and the users I haven't met

    Tower's release record follows a release from its draft to its outcome and writes every decision into git. What it's trying to fix, how it works, and why I keep a release's story in the GitOps repo. And an honest admission: Hangar has no users, so every part of it rests on assumptions about customers I've never met. Here they are, with how I'd test each one.
  3. October 25, 2026 · 10 min read

    Paving the cloud

    Airframe can now hand an app a queue, a bucket or a managed PostgreSQL database on AWS or Azure, with the security already on. Why that's the point where a platform stops being a nicer way to talk to Kubernetes: what a paved road to a cloud resource is made of, why the missing field is the policy, why identity is the real road, and what's still open.
  4. October 12, 2026 · 14 min read

    Breaking the glass

    Every platform team gets the pod exec finding, and every attempt to remove exec meets the same pushback. How I kept the capability in Tower and locked it down: a debug container instead of exec, no credential for anyone, a second person on production, six admission policies, a recording of every byte, and an honest grade of how secure it really is.
  5. October 5, 2026 · 11 min read

    A service catalog that grows with the company

    Hangar is Kubernetes-native, but the people it serves don't all run on Kubernetes. In two days, its catalog learned to offer AWS Lambda functions, Azure Functions and three cloud deploy targets. Why an API in front of the cloud lets a catalog grow with a company, and how the architects' and security team's rules can live inside it as code.
  6. October 3, 2026 · 10 min read

    Why Hangar runs its tests in Testkube

    A proof of concept with a team of test engineers sold me on Testkube: tests as Kubernetes resources, parallel runs, any framework, and one place to see every result. How it works, why it fits an API-driven control plane, how Glidepath runs it today, and what the free tier taught me.
  7. September 30, 2026 · 12 min read

    Why a platform still needs a service catalog

    People and AI agents are going to be building software side by side for a long time. The service catalog is where the platform writes down what it offers, precisely enough for both. Why I think it matters more now than ever, where I'd push back on the usual version, and how I'd build one, starting with the developers.
  8. September 30, 2026 · Building Airframe, part 1 · 11 min read

    Building Airframe: the start of my Crossplane journey

    I'd wanted to try Crossplane on one small secret store. Instead I built a whole service catalog on it. What six weeks of Airframe taught me about readiness, API budgets, and what a composition means when it renders nothing.
  9. September 28, 2026 · 9 min read

    What Hangar costs, and where Crossplane stops

    Forty-seven tools is a bill, not a feature. What it costs to run, what I'd cut for a smaller team, and the line I draw between things that should be reconciled and things that should just happen once.