DevOps & SRE notes

A web interface for Sealed Secrets by Bitnami.

https://github.com/bakito/sealed-secrets-web

In this captivating tutorial, Noah H explores the powerful capabilities of eBPF technology and Tetragon for enhancing Kubernetes security through runtime monitoring and policy enforcement. The author provides valuable insights into how these tools can detect suspicious activities, prevent container escapes, and enforce security policies directly at the kernel level without significant performance overhead.

https://medium.com/@noah_h/kubernetes-security-ebpf-tetragon-for-runtime-monitoring-policy-enforcement-819b6ed97953

This informative piece by bm54cloud explores the intricacies of deploying and updating Zarf packages in air-gapped environments. The author provides valuable insights into overcoming the unique challenges faced when working with systems disconnected from external networks.

https://medium.com/@bm54cloud/deploy-and-update-zarf-packages-in-an-air-gap-b2e3ec43abf7

Homogeneous Kubernetes clusters at scale on any infrastructure using hosted control planes.

https://github.com/gardener/gardener

A more powerful alternative to kubectx and kubens

https://github.com/sbstp/kubie

Understanding how to secure Linux containers requires a deep dive into tools like seccomp, which can restrict the system calls available to containerized processes. In this technical guide, the fourth installment of the Container Internals Series breaks down how seccomp filters work, their real-world impact on container security, and practical steps to implement custom seccomp profiles for hardened deployments.

https://levelup.gitconnected.com/container-internals-series-part-4-seccomp-d88543988709

Upgrading from Node.js 18 to 20 brought unexpected performance impacts to a Kubernetes-deployed service, as detailed in this technical recap. The experience-driven story reveals how changing memory reservations on Kubernetes pods can shrink Node.js heap spaces—specifically the "new space"—triggering heavier garbage collection and higher CPU load, and how adjusting the --max-semi-space-size parameter restored both speed and stability.

https://deezer.io/node-js-20-upgrade-a-journey-through-unexpected-heap-issues-with-kubernetes-27ae3d325646

kubectl-modify-secrets allows user to directly modify the secret without worrying about base64 encoding/decoding

https://github.com/rajatjindal/kubectl-modify-secret

A CLI utility to sort Terraform variables and outputs

https://github.com/AlexNabokikh/tfsort

Meeting customers’ rising expectations for security, speed, and personalization demands a new approach to computing infrastructure, which is exactly where distributed cloud comes in. This feature explains why developers must look beyond traditional centralized cloud models—adopting distributed cloud computing to optimize performance, comply with data regulations, and deliver truly customized services at scale.

https://thenewstack.io/why-developers-need-to-care-about-distributed-cloud-computing/

While GitOps has brought consistency and innovation to Kubernetes deployments, its reliance on git-based workflows and tools like ArgoCD and Flux still leaves important challenges unsolved. This article explores both the real-world progress and the limitations of GitOps, from deployment strategies and multi-cluster rollouts to issues around permissions, secrets management, and the need for solutions that go beyond git as the sole source of truth.

https://itnext.io/realizing-the-potential-of-gitops-263051baff04

Generate JSON Schema files based on a Terraform configuration

https://github.com/HewlettPackard/terraschema

Automating Terraform with the power of make.

https://github.com/tfmake/tfmake

Achieving end-to-end visibility for Python data pipelines is essential for ensuring quality and reliability in modern data architectures. This hands-on walkthrough from Elastic Observability Labs explains how to implement OpenTelemetry (OTEL) in your Python ETL scripts—covering automatic instrumentation, manual tracing, performance metrics, and anomaly-driven alerting—to proactively monitor, troubleshoot, and optimize your entire pipeline lifecycle using Elastic’s platform.

https://www.elastic.co/observability-labs/blog/monitor-your-python-data-pipelines-with-otel

Tail-based sampling unlocks deeper insights into distributed systems by allowing OpenTelemetry users to prioritize traces that matter most, such as those with errors or slow responses. This guide explains how tail-based sampling works, its differences from head-based sampling, and provides a practical walkthrough for setting up a two-tier OpenTelemetry Collector architecture that intelligently filters traces for more actionable observability.

https://itnext.io/empower-your-observability-tail-based-sampling-for-better-tracing-with-opentelemtry-243ca2cc55d1

Python interpreter embedded in Elixir

https://github.com/livebook-dev/pythonx

Kaniko is dead
🧊 This project is archived and no longer developed or maintained. 🧊

https://github.com/GoogleContainerTools/kaniko

System tray in your terminal

https://github.com/Levizor/tray-tui

Slow container startup times can cripple the productivity of Kubernetes teams managing large Docker images—sometimes dragging deployments out for hours. In this feature, Kazakov Kirill shares a practical strategy for pre-warming nodes and leveraging image caching, dramatically reducing cold starts and disk pressure during mass pod rollouts in Amazon EKS clusters.

https://hackernoon.com/how-to-optimize-kubernetes-for-large-docker-images