Val Kafedzhy

AI Infrastructure & Enterprise Platform Architect. 20+ years designing the networking, platform, and security layer under large systems, lately under AI at scale. Writing production-grade reference architectures at vkafed.com.

BGP for the AI Era: Multi-Region Routing for Inference Workloads

by

Every network team that has run global web traffic thinks it already understands multi-region routing. Then it puts a GPU inference cluster behind that same design and watches its assumptions fail, one at a time. BGP multi-region routing for inference workloads looks like the CDN playbook at first glance. It isn’t. The failure modes are … Read more

Service Mesh vs eBPF-Native Data Planes: How to Choose

by

Every platform team that runs Kubernetes past a few dozen services eventually has the service mesh vs eBPF argument, usually in a design review where one engineer points at fleet-wide CPU graphs and says the Envoy sidecars are costing too much, and another engineer points at a canary rollout ticket and says none of that … Read more

Zero Trust Networking Beyond the Buzzword: An Enterprise Reference Architecture

by

Every vendor booth at RSA sells “Zero Trust” like it’s a SKU. It isn’t. A zero trust network architecture is a set of design principles: identity-aware access, least privilege by default, policy enforced in the data path, and an assume-breach posture. It is not a box you rack, a license you renew, or an agent … Read more

eBPF in Production: Kernel-Level Observability and Security

by

Every platform team that has bolted a service mesh sidecar onto every pod eventually asks the same question: why run a full proxy per pod just to see and control traffic the kernel already handles? That question is what pushed a lot of us toward eBPF observability and security. Rather than stack another layer on … Read more

IPv6 at Enterprise Scale: A Migration Playbook

by

Ask a network architect why they’re finally doing an enterprise IPv6 migration and “we’re running out of IPv4 addresses” is almost never the honest answer. Nobody sitting in a data center cares about the global IPv4 free pool. That argument was settled a decade ago, and either way it was never their problem. The trigger … Read more

Creating a New CA (SHA-512, 4096-bit) with PKCS #11 Smart Card Storage and Subordinate CA

by

Today, I will walk through the process of creating a new Certificate Authority (CA) using a 4096-bit RSA key and SHA-512 as the signature hash algorithm. I will also store the private key securely on a PKCS #11–compatible smart card, and then create a subordinate (sub) CA using the root CA. Throughout this guide, I … Read more

Running PostgreSQL in Docker on my Mac

by

It’s extremely convenient to run your local tools, like RDMS, development environments and so on on Docker containers on Mac. To be honest with you, I hate installing a bunch of software on my Mac, and that’s the main reason why do I use containers for my local development. Before doing that manual, make sure … Read more