DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
Sidecar-free service mesh: Cilium Service Mesh next to Istio Ambient
Cilium Service Mesh handles mTLS and L7 routing on the eBPF datapath with no separate proxy components at all — unlike Istio Ambient, which drops the sidecar but keeps ztunnel and waypoint. We compare the architectures, the honest limitations, and turn on mTLS in a cluster that already runs Hubble.
-
Flux 2.8: CEL-based health checks and what they change for release gating
Flux 2.8 adds healthCheckExprs — CEL expressions for health checks in Kustomization and HelmRelease. We cover the syntax, migrating an existing resource, and how it differs from canary checks in Argo Rollouts/Flagger.
-
OBI: zero-code application tracing via eBPF, the Grafana Beyla successor
OpenTelemetry eBPF Instrumentation (OBI) traces HTTP/gRPC/SQL straight from the kernel — no in-container agent, no line of application code touched. We look at how OBI differs from Hubble, Tetragon and Pyroscope, how it plugs into an OTel Collector you already run, and where zero-code instrumentation hits its ceiling.
-
OpenCost: cost-allocating a Kubernetes cluster down to the namespace
OpenCost is a CNCF project that allocates Kubernetes cost by namespace, deployment, and label — no commercial subscription required. We cover the allocation model, how it differs from Kubecost after IBM's acquisition, and how to install it next to a Prometheus you already run.