Notes on Infrastructure AI|Cloud|Security|Networking
Field notes and practical guides from Sebastian Maniak — gateways, agents, Kubernetes, and the systems that keep production running.
How To: Deploy Standalone agentgateway on Render — One HTTPS URL for UI, LLM, and MCP
Most of what I’ve written about agentgateway runs on Kubernetes. That’s the right home for it in production. But if you want something fast that runs in render.com and all you want is a public HTTPS URL you …
Read article →Latest writing
View the full archive →How To: Per-Key Token Budgets in agentgateway 1.5.0 — Configuring Budgets, Token Costs, and Models
Virtual API keys have always answered two governance questions well: who is calling and which models are they allowed to reach. They never answered the third …
One Front Door for Every Tool: MCP Multiplexing Through agentgateway
Here is a problem you don’t have with one MCP server, and can’t avoid with six. You wire up an MCP server for your firewall so an agent can read …
The After-Hours Kill Switch: Daytime Claude, Nighttime Grok, One CEL Expression
Here’s a decision every team using premium models eventually faces, usually after reading a bill: the expensive model is worth it during the workday, and …
The Art of the Possible: Governed Sandbox Agents, and an Arista Operator That Can't Go Rogue
Ask a network engineer if they’d let an AI run commands on their production fabric and you’ll get a very short answer. The instinct is correct: a …
How To: Build an AWS Budget SandboxAgent on kagent + Agent Substrate
I already wrote the why — why secure sandbox substrates are the future. This one is the how. Same agent, but from the build side: every object you apply, where …
A GCP Budget SandboxAgent on kagent — and the Value of an Agent That Says "Unavailable"
This is the GCP sibling of my AWS budget SandboxAgent: a gVisor-isolated agent that answers What’s our us-east1 spend this month, and are we over …