Archives
All the articles I've archived.
-
Istio ambient: a service mesh without sidecars
Istio's ambient mode reached GA and removes the main argument against service mesh — a sidecar in every pod. We cover the ztunnel + waypoint architecture, mTLS without restarts, and rolling out L7 only where it's needed.
-
Karpenter: just-in-time nodes and half the cluster bill
Cluster Autoscaler scales pre-sized node groups, Karpenter picks the right instance for the actual pending pods and collapses the cluster when idle. NodePool/NodeClass, consolidation, spot fallback, and the traps that block it — with a working manifest.
-
External Secrets Operator: Vault secrets in Kubernetes without copy-paste
External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.
-
Trivy in CI: catch vulns and generate an SBOM before prod
One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.
-
Sentry: catch prod errors before your users do
Logs say 'something broke'; Sentry says what, for whom, and in which release. Error grouping, breadcrumbs, releases and source maps, how to quiet the noise, and how to self-host it.
-
Gateway API over Ingress: migrating before ingress-nginx dies
kubernetes/ingress-nginx hit End-of-Life on March 24, 2026 — the repo is frozen, no bugfixes, no security patches. A walkthrough of the Gateway API resource model, converting with ingress2gateway 1.0, and the migration traps, with a canary-routing example.
-
Backstage in a weekend: an IDP and golden paths for a small team
An Internal Developer Platform isn't only for enterprises: a minimal Backstage in docker-compose with one Software Template gives a service catalog and a 'new service in one click' win already at 3-5 engineers. What it takes and where the traps are.
-
AI SRE agents in 2026: what they actually do and where they break
AWS DevOps Agent and Azure SRE Agent both hit GA in March 2026. We break down the working model of AI SRE agents: what they actually do (triage, correlation, runbook execution), where they break, and how to build human-in-the-loop with approval gates so the agent stays a co-pilot instead of a new source of incidents.
-
CloudNativePG in production: HA, backups, and major upgrades without downtime
Standing up CloudNativePG is easy — production begins on day-2. We cover automatic failover and split-brain protection, ScheduledBackup and PITR restore (Barman Cloud Plugin), the metrics that actually matter, minor and major upgrades without a long downtime, and why prod rests on a tested restore, not a configured backup.
-
CloudNativePG: production-ready Postgres on Kubernetes without voodoo
CloudNativePG turns "Postgres in k8s" from an anti-pattern into a normal way to keep the database next to the app: one Cluster CR gives you a primary and replicas, automatic failover, S3 backups via the Barman Cloud Plugin, and PgBouncer through Pooler. We walk through a 3-pod manifest, the storage traps, and how to test failover.
-
Progressive delivery: canary with automated rollback on Flagger
Flagger turns a plain Deployment into progressive delivery with automated metric-based rollback: the Canary CR, canary/blue-green/A-B strategies, error-rate and p95 analysis via MetricTemplate, and a working manifest with 10/30/50% steps.
-
Kyverno vs OPA Gatekeeper: when to pick which
Kyverno 1.17 promoted CEL to v1, Gatekeeper v3.22 integrated ValidatingAdmissionPolicy from upstream. Both projects are now stable — the choice depends on where your Kubernetes ends. A practical matrix: YAML vs Rego, validation/mutation/generation, and the hybrid option with full code examples.
-
Flux in one evening: GitOps for a single small cluster
GitOps on a single small cluster without an operator zoo: what Flux is, why a reconciler beats kubectl apply from CI, how to run flux bootstrap, and how to assemble one root Kustomization that syncs the whole cluster from git.
-
OpenTelemetry Collector: a minimal setup you can ship to prod
Why you need the OpenTelemetry Collector, how its receivers/processors/exporters pipeline works, how an agent differs from a gateway, and how to build a minimal but production-grade setup with docker-compose and Tempo.
-
eBPF without the pain: Cilium and network observability in Kubernetes
What eBPF is in plain terms, why Cilium beats kube-proxy and sidecars, how Hubble shows flows and drop reasons, and what you need to stand it all up in a kind cluster in an evening.
-
SLSA Level 2: what build provenance is and why it isn't SBOM
SLSA Level 2 in practice: how build provenance differs from an SBOM, why L2 is a realistic target, how the GitLab Runner itself generates a non-forgeable attestation, and how to verify it with glab/cosign and at admission.
-
The Intervals.icu MCP server in Claude, behind Pomerium
How we connected the Intervals.icu MCP server to Claude and locked it behind Pomerium auth. Plus: how to build a dedicated Claude project and turn it into a personal coach with instructions.
-
Keyless image signing: Sigstore and cosign in CI
Keyless container image signing with Sigstore: cosign, Fulcio and Rekor sign artifacts against your CI's OIDC identity with no long-lived keys. We walk the flow, the pitfalls, and a minimal GitLab CI pipeline with admission-time verification.
-
Self-hosted Matrix + Element: a messenger that's actually yours
Why a self-hosted Matrix server with the Element client is more private and freer than Telegram, WhatsApp or Signal — federation, data ownership, E2EE and bridges, plus a minimal Synapse + Element Docker deploy.
-
Deploy Astro to Cloudflare Pages: Git Integration and GitHub CI/CD
Two ways to deploy Astro to Cloudflare Pages: connect the repo right in the dashboard (push to main = auto deploy, free per-branch previews, custom domain with TLS) or build in GitHub Actions and ship dist via Wrangler. Build settings, custom domain, a dev environment, and the full workflow included.
-
HTTP/3 and QUIC Explained Simply
How HTTP/3 and QUIC differ from HTTP/1.1 and HTTP/2, why the transport moved from TCP to UDP, and what you need to turn HTTP/3 on for your own server.
-
Backing Up Databases and Files to S3 with Restic + Healthchecks
Updated:A practical guide to backing up databases and files to S3 with Restic and Healthchecks monitoring: encryption, deduplication, scheduling, and restore verification.
-
A Lightweight Proxy
Updated:How to quickly spin up a lightweight proxy server in Docker for testing, CI/CD and temporary infrastructure: minimal configuration and launch in a couple of minutes.
-
20 Cybersecurity Tools for 2025
An overview of 20 cybersecurity tools for 2025 for pentesting and auditing: scanners, exploitation frameworks, traffic and network analysis — with usage examples.
-
A Minimal Zsh Setup on macOS
Updated:A minimal Zsh setup on macOS without heavy frameworks: autocompletion, syntax highlighting, a handy prompt, and aliases — fast and free of bloat.
-
Installing Kali Linux on a Hetzner Server
How to install Kali Linux on a Hetzner server with no prebuilt image: booting via the rescue system, partitioning disks and deploying for cloud pentesting.
-
A Guide to Setting Up pgBackRest for PostgreSQL
A guide to setting up pgBackRest for PostgreSQL: full and incremental backups, S3 storage, point-in-time recovery (PITR), and backup verification.
-
NetBird: A Modern Zero Trust VPN
NetBird is a modern self-hosted Zero Trust VPN built on WireGuard: peer-to-peer connections, automatic NAT traversal, and simple access control with no single point of failure.
-
Standardization in Security: ISO/IEC 19249
An overview of the ISO/IEC 19249 standard: security architecture and system design principles — how to bring scattered protection practices into a single model.
-
A Complete Guide to Preparing for and Playing CTF (Capture The Flag)
A complete guide to preparing for CTF (Capture The Flag): challenge categories, tools, practice resources, and a step-by-step strategy for competing successfully.
-
Container Security: A Practical Checklist for Implementation
Updated:A practical security checklist for Docker and Kubernetes containers: images, privileges, secrets, networking, and runtime — what to verify before shipping to production.
-
YubiKey 5
YubiKey 5 — a multi-protocol hardware key for two-factor authentication: FIDO2, U2F, OTP, PGP, and SSH — how to set it up and why you need it.
-
Backing Up Docker Containers with Offen
How to set up automated daily backups of Docker volumes to S3 with offen/docker-volume-backup: configuration, scheduling, encryption and restore.
-
MDT Deployment & Administration. Part 4: Bootstrap.ini and CustomSettings.ini
Deploy Windows with MDT, part 4: configure Bootstrap.ini and CustomSettings.ini to automate installation parameters and customize the deployment process.
-
Obtaining an SSL Certificate with Cloudflare and Let's Encrypt, and Configuring Nginx
How to obtain a free Let's Encrypt SSL certificate, set it up with Cloudflare, and wire it into Nginx: a step-by-step guide with HTTPS and automatic renewal.
-
MDT Deployment & Administration. Part 3: Creating a New Task Sequence
Updated:Deploy Windows with MDT, part 3: create a new Task Sequence — a step-by-step walkthrough of configuring the task sequence for automated OS installation.
-
MDT Deployment & Administration. Part 2: Installing and Configuring MDT
Updated:Deploy Windows with MDT, part 2: install and configure Microsoft Deployment Toolkit, create a deployment share, and prepare your install.wim images.
-
MDT Deployment & Administration. Part 1: Installing and Configuring WDS
Deploy Windows with MDT, part 1: install and configure WDS (Windows Deployment Services) for PXE network boot and fully automated OS installation.
-
Getting Started with Docker
An introduction to Docker for beginners: what containers, images, and volumes are, how they differ from virtual machines, and how to run your first application.
-
Proxmox Cloud-Init 24.04 Tutorial
How to create an Ubuntu 24.04 virtual machine template in Proxmox with Cloud-Init: automating VM setup, SSH keys, and fast cloning — step by step.
-
Order in IT: On the Importance of Pulling Up Baobabs
Why it matters to fix small problems in your IT infrastructure before they grow out of control: on technical debt, order, and the discipline of operations.
-
Getting Started with SSH
An introduction to SSH for beginners: how the secure remote access protocol works, generating keys, connecting to a server, and basic commands.
-
Cloudflare Zero Trust
Set up secure access to self-hosted services with Cloudflare Zero Trust and Tunnel: no open ports, with authentication and access policies built in.
-
Proper, Secure SSH Configuration
How to securely configure an SSH server: keys instead of passwords, disabling root login, changing the port, fail2ban, and other practices to defend against brute-force and attacks.
-
SSL Certificates Made Simple
Updated:A simple explanation of SSL/TLS certificates: what X.509 is, how encryption works, the chain of trust, and why a website needs HTTPS — without unnecessary theory.