stuff I figured out the hard way
  1. 1. More Pods Never Helped: The App That Was Starved of Memory Its Whole Life

    How an inherited app that crashed and slowed down at random turned out to be capped below its real memory needs from day one - and why scaling out never fixed it

    | kubernetes, eks, aws
  2. 2. SSL Required: Getting CA Certificates Through AWS, Azure, and GCP Secret Managers Intact

    Managed databases that enforce SSL need a CA certificate in every pod. How to store PEM certificates in AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager without mangling the newlines - and mount them with External Secrets

    | ssl, secrets-manager, azure
  3. 3. Migrating 50+ TCP Services to Envoy Gateway: The Silent Security Group Gotcha

    How I moved a fleet of TCP services from ingress-nginx to Envoy Gateway using the Gateway API - and how AWS security group quotas caused a silent freeze that took down the data plane

    | envoy-gateway, kubernetes, gateway-api
  4. 4. Replacing ingress-nginx with Envoy Gateway: Rate Limiting, IP Whitelists, and OAuth2

    Migrating from ingress-nginx to Gateway API with Envoy Gateway - and getting rate limiting, IP allowlists, and auth as native policies instead of annotations

    | envoy-gateway, kubernetes, gateway-api
  5. 5. Kubernetes CD: Push, Pull, or Progressive — Pick Your Pain

    A practical comparison of three CD strategies for Kubernetes: pushing from CI, pulling with GitOps, and progressive delivery with canary rollouts

    | kubernetes, cicd, argocd
  6. 6. Serving Private S3 Files with CloudFront Signed URLs

    How I built a self-service file portal for clients using CloudFront signed URLs, an S3 bucket, and a Python script that generates expiring download pages

    | aws, cloudfront, s3
  7. 7. Hoop + EKS: Fine-Grained Kubernetes Access via IAM Role Chaining

    How I set up auditable, role-based kubectl access through Hoop using IRSA, IAM role chaining, and Kubernetes RBAC

    | eks, kubernetes, aws
  8. 8. Shared Pod Storage in GKE: Why We Chose NFS Over GCS Fuse

    Comparing ReadWriteMany storage options in GKE - GCS Fuse looked cloud-native, but NFS won for inter-pod scratch space

    | gke, kubernetes, gcp
  9. 9. GitOps Self-Service: Managing 50+ Services with GitHub Actions and ArgoCD

    How I accidentally built an Internal Developer Platform using workflow_dispatch, yq, and ArgoCD for full service lifecycle management

    | eks, kubernetes, github-actions
  10. 10. Running 50+ TCP Services on EKS: Working Around NLB Limits

    How I architected a fleet of StatefulSets behind multiple NLBs for a GDPR-compliant, cross-region deployment

    | statefulset, eks, kubernetes
  11. 11. EFS on a Swarm: Taming Memory Bloat at Scale

    How mounting EFS on hundreds of pods drove memory through the roof, and the DaemonSet trick that saved us

    | kubernetes, efs, aws
  12. 12. From $2,500 to $130: Taming Runaway Database Backups

    How I cut backup costs by 95% with a simple Lambda and S3 lifecycle policies

    | rds, backups, aws
  13. 13. Automating CloudFront SSL in AWS China (Where ACM Doesn't Exist)

    How I automated Let's Encrypt certificate renewals for CloudFront distributions in AWS China using IAM server certificates

    | cloudfront, china, aws