Proxy Policy DSL | Kubernetes-Native Operations with | homelabird-blog
UpdatedJan 23, 2026•3 min read
1 views
K8s Ops with Minecraft Part 3: Proxy Policy
Part 3 documents the proxy policy DSL, routing order, control-plane APIs, and audit architecture.
Developing Kubernetes-Native Operations with Minecraft - Part 3: Proxy Policy DSL and the Control Plane#
The proxy layer deserves its own control plane. This post captures the current thinking around a Go-based policy manager that keeps Velocity or a Go data plane honest through signed policy snapshots, audit logs, and distributed rollout controls.
create table policy_version ( id bigserial primary key, name text not null, hash text not null, created_at timestamptz not null default now());create table server_group ( id bigserial primary key, policy_version_id bigint not null references policy_version(id), selector jsonb not null, routing jsonb not null);create table audit_event ( id bigserial primary key, ts timestamptz not null default now(), actor text, action text not null, details jsonb);
The schema tracks versions, selectors, routing parameters, audits, and can be extended with blocklists, auth tokens, and player tags.
We added mcctl mermaid lint to validate Mermaid blocks across documentation. The command walks Markdown/MDX files, pulls every mermaid` block, and runs @mermaid-js/parser via scripts/mermaid-lint.mjs. If a diagram has invalid syntax, the invocation fails with file/line context so you can fix the diagram before publishing.
The policy DSL defines routing, access control, and packet filters in one place.
The control plane signs snapshots, exposes route/access APIs, and keeps data planes in sync.
homelabird
Sharing hands-on cloud infrastructure and DevOps experience. Writing about Kubernetes, Terraform, and observability, and documenting lessons learned as a solo operator.
