DevOps&SRE Library

This blog aims to provide a practical example of how core tools like Kubernetes, Terraform, and DevContainers can be combined to build a local data platform in a structured and maintainable way.

Jenkins might feel like legacy tech, but it's still powering CI/CD at thousands of companies. Instead of ripping it out, here's how to modernize it with Kubernetes — solving cost tracking, resource isolation, and scalability problems along the way.

This article explains how Cosign, Kyverno, and Harbor can work together to enforce image signature verification in Kubernetes. The approach is well-suited for enterprise environments with private registries, custom TLS certificates, and restricted access to public transparency logs.

Operators make life easier, but they are not always an option. In this post, I'll walk through a practical way to deploy large language models on OpenShift without relying on the OpenShift AI or NVIDIA operators. The approach uses llama.cpp as a lightweight runtime engine and runs a quantized GGUF model to enable efficient inference with minimal dependencies.

This article is about the patterns that actually work when you're managing real databases in Kubernetes, not hello-world demos: when your boss says "everything should be containerized" but your databases laugh in the face of ephemeral pods, and when GitOps meets a 200GB production database that absolutely cannot lose a single transaction.

The Kubernetes story is one I hear often. Teams adopt K8s expecting operational simplicity, only to discover they've traded application complexity for infrastructure complexity. For a solo founder focused on content creation, maintaining a Kubernetes cluster was simply the wrong trade-off.

If you're running PostgreSQL on Kubernetes, chances are you've used Bitnami's popular Helm charts. They've been a go-to for many, but a significant change is on the horizon. As outlined in this GitHub issue, Bitnami is moving its production-ready charts and images to a commercial offering. For those of us who rely on and advocate for open-source solutions, this means it's time to find a robust alternative.

In Kubernetes v1.35, we're introducing Extended Toleration Operators as an alpha feature. This enhancement adds Gt (Greater Than) and Lt (Less Than) operators to spec.tolerations, enabling threshold-based scheduling decisions that unlock new possibilities for SLA-based placement, cost optimization, and performance-aware workload distribution.

How we transformed engineering productivity by building an Internal Developer Platform (IDP) that now processes ~50M API calls per day, manages 14,000 VMs, and powers 80+ releases per year and what you can learn from our journey.

In this post I'll describe how to execute code on every Pod in many Kubernetes clusters when using a service account with nodes/proxy GET permissions. This issue was initially reported through the Kubernetes security disclosure process and closed as working as intended.

kubecfg is a Kubernetes kubeconfig manager for people who switch contexts often and need more than a thin wrapper around kubectl config.

An open source agent that lives on your machines 24/7, keeps your apps running, and only pings when it needs a human. All the upside of a PaaS, none of the lock-in.

ExternalDNS is a Kubernetes add-on for automatically managing DNS records for Kubernetes ingresses and services by using different DNS providers. This webhook provider allows you to automate DNS records from your Kubernetes clusters into your MikroTik router.

A PowerDNS webhook for cert-manager

I'm excited to announce the implementation of an improved conversion formula from cgroup v1 CPU shares to cgroup v2 CPU weight. This enhancement addresses critical issues with CPU priority allocation for Kubernetes workloads when running on systems with cgroup v2.

I was previously part of an organization with 500+ devs with more than 25+ AWS accounts for each client which had to be managed by the DevOps team. The number of people in DevOps team was smaller than the accounts and all of them were mostly active with resources being allocated and deallocated frequently. We utilised many AWS services like EC2, S3, EKS, SageMaker, RDS, Redshift, Cloudfront, Route53, SSM etc

If you are leading an engineering team today, your job isn't to prevent failure. It is to design systems that thrive in it. This is the discipline of Chaos Engineering. It is not just about breaking things in production; it is a scientific method for validating resilience.

This article will also focus on GKE Gateway, but now we're going to explore Internal Regional Gateway for load balancing east-west traffic (i.e. service-to-service) to your application. Leveraging our learnings from my previous post, we'll include the GKE external gateway in this architecture while using the Internal Regional Load Balancer gatewayclass (gke-l7-rilb) to load balance the service-to-service communications in the Bank of Anthos application.

Every AI agent eventually asks for the same thing: "Let me run a program." Sometimes it's a harmless pytest. Sometimes it's pip install sketchy-package && python run.py. Either way, the moment you let an agent execute code, you're running untrusted bytes on a machine you care about.