Arif Kurnaz

Go, Java, Vue 3 and TypeScript, PostgreSQL, Docker, Kubernetes (admission webhooks, operators, Helm), cosign and in-toto attestations, Trivy.

SOC 2, the EU Cyber Resilience Act and NIS2, read as an engineer: what the text actually asks of a cluster, and what evidence of a control operating looks like to an auditor.

Attestkeep 1.0 (attestkeep.com): a validating admission webhook for Kubernetes with a scanner, a tamper-evident admission ledger and signed evidence packages for eight compliance frameworks.

Reading the mechanism, not the claims. If you have been through a SOC 2 Type II with containers in scope, or run admission control in production, tell me where I am wrong.