DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
External Secrets Operator: Vault secrets in Kubernetes without copy-paste
External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.
-
Trivy in CI: catch vulns and generate an SBOM before prod
One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.
-
Sentry: catch prod errors before your users do
Logs say 'something broke'; Sentry says what, for whom, and in which release. Error grouping, breadcrumbs, releases and source maps, how to quiet the noise, and how to self-host it.
-
Gateway API over Ingress: migrating before ingress-nginx dies
kubernetes/ingress-nginx hit End-of-Life on March 24, 2026 — the repo is frozen, no bugfixes, no security patches. A walkthrough of the Gateway API resource model, converting with ingress2gateway 1.0, and the migration traps, with a canary-routing example.