01 / distributed systems · security
Distributed
Secrets Manager
A Vault-inspired secrets service that treats encryption, availability, and recovery as one system. Encrypted mutations move through a Raft log and become visible only after a quorum has persisted them.
- Go
- Raft
- mTLS
- AES-256-GCM
- Docker
01.1
a write is a group decision.
The leader authenticates the request, encrypts the new version, and appends only ciphertext to its write-ahead log. Success waits for a majority—not merely a local disk write.
PUT /secret
node 01leaderWAL · append · fsync
node 02followerpersisted ✓
node 03followerreplicating
2 / 3 → committed
01.2
keys protect keys.
Each secret version receives a fresh data key. A vault-wide encryption key wraps those data keys; a root key protects the vault key. Rotation can replace wrapping keys without touching every encrypted payload.
[ root key ]split into recovery shares
│ wraps
[ vault KEK ]unlocked only in memory
│ wraps
[ version DEK ]new random key per version
│ encrypts + AAD
{ ciphertext }bound to path + version
failure model
A leader can disappear. A process can restart. A follower can fall behind. The system recovers its log, elects a replacement, repairs divergence, and refuses to invent consensus when quorum is gone.
3independent nodes
2/3write quorum
3-of-5example unseal threshold
02 / operating systems · virtualization
VM Resource
Coordinator
Two periodic C control loops observe live KVM guests through libvirt, then rebalance CPU placement and memory allocations without destabilizing the workloads they manage.
02.1
measure, place, stabilize.
The scheduler samples vCPU time, estimates utilization, and pins virtual CPUs to physical cores. It seeks a balanced host while avoiding needless migrations once the load is stable.
v0v1v2v3v4v5v6v7
↓ sample → sort → pin ↓
σ ≤ 5 · balanced / stable
02.2
memory moves with pressure.
The coordinator expands pressured guests and gradually reclaims unused capacity through ballooning. Guest floors and a host reserve remain hard constraints, even when every VM wants more.
host memory / 16 GB
vm 01pressure ↑
vm 02steady
vm 03idle ↓
vm 04steady
vm 0364 MBvm 01
guest reserve ≥ 100 MB · host reserve ≥ 200 MB
tested under contention
The policies were exercised with more virtual CPUs than physical cores and multiple guests competing for memory—checking convergence, remapping restraint, and safety boundaries under load.
8virtual machines
4physical cores
16 GBshared host memory