In this post, we'll take a polyglot microservice app from local source code to a production Kubernetes cluster with TLS, Auth0 login, and Stripe webhooks — all working end-to-end. No cloud staging environment. No Docker Compose. No YAML by hand.

Here we’ll walk through a small, concrete demo where a single hub control plane actively reconciles cert-manager.io/v1 Certificate resources across multiple downstream clusters, issues TLS Secrets, and does so safely from multiple controller replicas without relying on leader election.

Step-by-step guide to deploying a private Amazon EKS cluster with zero public API exposure, self-hosted OpenVPN access, kube-prometheus-stack monitoring, and Route 53 private DNS — all automated with Terraform.

This article walks through a production deployment that solves all of the above using llm-d for intelligent inference scheduling, Istio as a Gateway API provider with Inference Extension support, and LiteLLM as a unified API gateway.

Chainloop is an open-source evidence store for your Software Supply Chain attestations, Software Bill of Materials (SBOMs), VEX, SARIF, QA reports, and more. With Chainloop, Security, Compliance, and Risk management teams can define security and compliance policies, what evidence and artifacts they want to receive, and where to store them. On the other hand, developers are shielded from all this complexity by being given simple instructions on what to provide when instrumenting their CI/CD pipelines.

OpenRun is an Apache-2.0 licensed open source web app deployment platform for deploying internal tools. OpenRun makes it easy to declaratively deploy containerized web apps. OpenRun can deploy apps on a single-node or onto a Kubernetes cluster. OpenRun provides declarative GitOps based blue-green deployment, OAuth/OIDC/SAML access controls, TLS certs & secrets management. OpenRun is built for teams to easily deploy internal tools, with full RBAC support. OpenRun apps are deployed directly from the git repo, no build server required. OpenRun scales idles apps down to zero and supports atomic updates across multiple apps.

Sealed Secrets Web is a web interface for Sealed Secrets by Bitnami. The web interface let you encode, decode the keys in the data field of a secret, load existing Sealed Secrets and create Sealed Secrets. Under the hood it uses Sealed Secrets service API to encrypt your secrets. The web interface should be installed to your Kubernetes cluster, so your developers do not need access to your cluster via kubectl.

Our ASP.NET Core pods on Kubernetes were OOM-killed every few hours during a pre-launch pilot. The managed heap was clean — 95% of the memory was native, invisible to every .NET diagnostic tool we threw at it.

As announced November 2025, Kubernetes will retire Ingress-NGINX in March 2026. Despite its widespread usage, Ingress-NGINX is full of surprising defaults and side effects that are probably present in your cluster today. This blog highlights these behaviors so that you can migrate away safely and make a conscious decision about which behaviors to keep. This post also compares Ingress-NGINX with Gateway API and shows you how to preserve Ingress-NGINX behavior in Gateway API. The recurring risk pattern in every section is the same: a seemingly correct translation can still cause outages if it does not consider Ingress-NGINX's quirks.

ctx treats your entire DevOps environment as a single switchable context. kubectx is great for what it does, but it only solves one piece of the puzzle: Kubernetes contexts. What about AWS/GCP/Azure credentials, SSH tunnels to databases, VPN connections, environment variables, Vault tokens, Git user configs, and browser profiles for SSO?

One static binary that takes a freshly created cluster from "API server answers" to "workloads can be deployed" — a declarative, idempotent DAG of helm, apply, wait, and friends. No kubectl, no helm binary, no bash.

Many Kubernetes environments rely on ingress-nginx as the primary entry point for external traffic. With the retirement of Ingress-NGINX in our environment, we needed to migrate to a new ingress solution. Instead of replacing it with another traditional ingress controller, we chose to adopt Istio and explore its service mesh–based traffic management capabilities.

The "should I run databases on Kubernetes?" debate is over. Zalando runs 4,000+ PostgreSQL clusters on Kubernetes. Bloomberg, Apple, and dozens of CNCF end-user companies do the same. The question is no longer whether it works — it is whether your team should do it, and if so, how to do it without losing data or sleep.

When deploying applications to Kubernetes, one of the first security concerns that arises is secret management. This article chronicles my journey of migrating a Grafana admin password from a hardcoded Helm value to AWS Systems Manager Parameter Store using the External Secrets Operator.

We have all been there. You are pushing a hotfix at midnight, you forget to remove a test API key you hardcoded during debugging, and it ends up in the main branch. Secrets leaking into version control is one of the most common and costly security mistakes in software development.

This cluster runs on a Raspberry Pi 3, inside a normal household network, behind an ISP router that cannot be replaced. The goal was not to build a "homelab". The goal was to design a small, portable, security-focused platform using the same principles I would apply in a professional environment.

A practical, production-ready cheat sheet to understand certificates, fix TLS handshake errors and debug real-world issues using OpenSSL, curl and Kubernetes.

A fault-tolerant, API-agnostic RPC load balancer for blockchain APIs.

At VictoriaMetrics, we built vlagent as a high-performance log collector for VictoriaLogs. To validate its performance and correctness under a real production-like load, we developed a benchmark suite and ran it against 8 popular log collectors. This post covers the methodology, throughput results, resource usage, and delivery correctness.

With the retirement of ingress-nginx I've seen a lot of frustrations with Gateway API migrations due to differences in some of the resource models. The common problem is that Ingress users are often running self-service models, where application teams fully own their ingress configuration, including TLS certificates.