I discovered open source during COVID.
Now I help others discover it.

Situation

The gadget DaemonSet's prometheus.io/port annotation still pointed at the legacy port 2223, but metrics had moved to the OpenTelemetry metrics operator listening on 2224. Prometheus service discovery was scraping a port nothing served.

Task

Restore correct out-of-the-box metrics scraping and keep the Helm chart aligned with the generated kubectl gadget deploy manifest.

Action

Pointed the scrape annotation at 2224, regenerated pkg/resources/manifests/deploy.yaml so both install paths match, and refreshed the stale comment to reference the current otel-metrics config key.

Result

Default Prometheus discovery works again with no manual override. Merged into main (fixes issue #4371).

• Kubernetes
• Helm
• Prometheus
• OpenTelemetry

• Merged PR #5721
• Fixes issue #4371

Evidence verified 2026-10-20 · figures are a point-in-time snapshot, not a live counter.

Situation

The AWS-maintained Bedrock Terraform module lacked image-content guardrails and used loosely typed list(map(string)) inputs, leaving gaps against the current AWS Cloud Control API schema and weak validation.

Task

Bring the module's guardrail and resource schemas in line with current Bedrock capabilities while keeping it backward compatible.

Action

Added input/output modality support so filters cover TEXT and IMAGE, converted guardrail configs to strongly typed list(object(...)), added automated-reasoning policy config and the remaining optional Cloud Control fields, and updated examples and docs.

Result

Teams can now declare text and image safeguards with earlier validation and better IDE autocomplete. Merged by an AWS maintainer after passing end-to-end tests (closes #161).

• Terraform
• AWS Bedrock
• Guardrails
• Cloud Control API

• Merged PR #162
• Repository

Evidence verified 2026-10-20 · figures are a point-in-time snapshot, not a live counter.

Situation

AgentCore gateways had no first-class Terraform support for REQUEST/RESPONSE Lambda interceptors, so teams had to wire Lambda access and gateway boundaries manually.

Task

Make gateway-boundary controls reusable and safe to configure through the module.

Action

Implemented a validated gateway_interceptor_configurations variable, integrated the interceptor block into the gateway resource, generated the required lambda:InvokeFunction IAM permissions automatically, added outputs, and documented usage with examples.

Result

Teams can add custom authorization, payload transformation, PII masking, and policy enforcement at the gateway boundary declaratively. Merged by an AWS maintainer (closes #21).

• Terraform
• AWS AgentCore
• IAM
• Lambda

• Merged PR #20
• Repository

Evidence verified 2026-10-20 · figures are a point-in-time snapshot, not a live counter.

3

PRs merged

Situation

The OWASP DevSecOps Guideline needed clearer security-gate guidance, faster and more reliable CI on pull requests, and it could not be cloned on Windows because some paths contained the pipe character.

Task

Improve the guideline's content quality and contributor experience across platforms.

Action

Renamed paths with invalid Windows characters so the repo clones on Windows (#98); expanded the Security Gates chapter with end-to-end CI/CD examples, a pipeline-placement diagram, and a severity-threshold table (#111); and reworked CI to run pre-commit only on changed files for PRs, dropping fail_fast and documenting local setup (#113).

Result

Three PRs merged into an OWASP Foundation project — improving documentation, CI ergonomics, and cross-platform access for all contributors.

• DevSecOps
• CI/CD
• pre-commit
• Documentation

• PR #98 — Windows path fix
• PR #111 — Security Gates examples
• PR #113 — CI on changed files

Evidence verified 2026-10-20 · figures are a point-in-time snapshot, not a live counter.