DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
Keycloak in Kubernetes: one OIDC provider for kubectl, Argo CD and Grafana — self-hosted SSO
kubectl — client certificates, Argo CD — a local admin, Grafana — its own user database. Setting up Keycloak 26.8 in Kubernetes as the single OIDC provider: Postgres on CloudNativePG, kube-apiserver flags, kubelogin, groups from realm roles, realm-as-code, and an honest bill for the JVM.
VictoriaMetrics instead of Prometheus+Thanos: one binary instead of three — when it's honest savings
Long-term metric storage on Prometheus means Thanos: sidecar, store gateway, compactor and query on top of S3. Where VictoriaMetrics single-binary covers the same with one process: active-time-series thresholds, the vmagent/vmalert/vmbackup ecosystem, two migration paths, and RAM/disk numbers.
Crossplane 2.0 and the coming v1.20 EOL: cloud infrastructure via GitOps instead of Terraform state
Crossplane v1.20 hits EOL with the v2.5 release in November 2026 — the migration window is closing. What changed in 2.0: compositions from any Kubernetes resource, provider functions instead of monolithic providers, delivery through Argo CD — and an honest answer to when Crossplane is not for you.
GPUs in Kubernetes without device plugins: how DRA changes accelerator allocation
Dynamic Resource Allocation (DRA) is the standard way to hand out GPUs since Kubernetes 1.34: a ResourceClaim instead of nvidia.com/gpu, attributes instead of counters, CDI instead of device mapping. We walk through the three new API objects, DRA mode in the NVIDIA GPU Operator, and what exactly breaks when you migrate.