Skip to content
View SoulKyu's full-sized avatar
39 followers · 25 following

Achievements

Achievement: Pull Sharkx3Achievement: StarstruckAchievement: Pair ExtraordinaireAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx3Achievement: StarstruckAchievement: Pair ExtraordinaireAchievement: YOLOAchievement: Quickdraw

Organizations

@numberly

Block or report SoulKyu

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
SoulKyu/README.md
Guillaume Legrain, Cybersecurity Platform Engineer

I build Kubernetes platforms where the network is default-deny, database credentials expire on their own, and alerts from every Alertmanager land in one place.

Numberly Cloud Native Days France 2026 Location

What I do

Mostly Go, mostly Kubernetes.

  • Default-deny clusters on Cilium, with policies generated from dropped Hubble flows and shipped through GitOps
  • Per-pod database credentials from Vault or OpenBao instead of static passwords
  • Prometheus and Alertmanager, and the UI on top of them
  • Sandboxed AI agents for ops: NixOS VM, no egress by default, tool denylist against prompt injection

Featured projects

vault-db-injector

Stars Go Vault

Kubernetes mutating webhook: each pod gets its own short-lived database credentials from Vault instead of a static password, renewed while the pod runs and revoked when it dies.

Docs · CND France 2026 demo

cpg

Stars Release Cilium

Cilium Policy Generator. It streams dropped flows from Hubble Relay and writes the CiliumNetworkPolicy that allows them, merged into your existing YAML for you to review and push. Writing policies by hand in a default-deny cluster is nobody's idea of a good Friday night.

kubectl krew install cilium-policy-gen

notificator

Stars Release Prometheus

A Karma replacement: one web UI for all your Alertmanagers, with sounds, notifications, acks, comments, assignments and OAuth.

▶ Live playground
More projects
  • leandro: AI SRE agent diagnosing Kubernetes incidents over Google Chat. It runs in a NixOS VM with default-deny egress and a tool denylist against prompt injection.
  • openwiki-cc: auto-generated, git-grounded documentation wiki for any repo (Claude Code plugin and Codex skill)
  • pi-agentic-platform: self-hosted agentic platform on the Pi SDK

Stack

Security & secrets

Platform

Observability

Code

Total stars

Top languages

Pinned Loading

  1. notificator notificator Public

    Notificator is a Karma replacement for alertmanager with sounds and notifications

    Go 83 9

  2. cpg cpg Public

    Cilium Policy Generator using hubble relay

    Go 94 2

  3. numberly/vault-db-injector numberly/vault-db-injector Public

    The Vault DB Injector automates secure database credential management in Kubernetes using Hashicorp Vault, providing credential injection, renewal, and revocation for pods.

    Go 50 3

  4. talos-kms-vault talos-kms-vault Public

    Forked from lightdiscord/talos-kms-vault

    Proxy between a Talos node and a Hashicorp Vault instance to enable KMS disk encryption

    Go 16 2

  5. github-scraping-agent-ai github-scraping-agent-ai Public

    Project that scape all github repositories, read them, analyse with an AI and return you on a discord webhook project that could interest you.

    Python 6

  6. openwiki-cc openwiki-cc Public archive

    Auto-generate and maintain a documentation wiki for any repo — native Claude Code plugin (/openwiki:wiki) & OpenAI Codex skill. A faithful port of OpenWiki: grounds every doc in your source & git h…

    Shell 14 2