DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
KRO: composite Kubernetes APIs without writing your own operator
Kube Resource Orchestrator bundles a Deployment, Service, ConfigMap, and an external Crossplane resource into a single composite CRD without a line of Go. We break down ResourceGraphDefinition, compare it to Crossplane Compositions and a condition-heavy Helm chart, and look at where KRO loses.
-
Scorecards for platform teams: measuring whether the service catalog actually works
A service catalog is a showcase; scorecards are the lever. How to compute quantitative security/reliability/documentation metrics on top of Trivy, Renovate, and Sentry you already run, via Backstage TechInsights, without buying a commercial IDP.
-
Teleport instead of a VPN: audited access to servers, Kubernetes, and databases
Teleport solves a different problem than NetBird or Cloudflare Tunnel: they give you network access, Teleport gives you audited access to a specific resource. We cover short-lived certificates instead of SSH keys and kubeconfig, session recording with tsh play, and resource-level RBAC — then wire up access to a test Kubernetes cluster with tsh kube login.
-
Database schema as code: Atlas on top of CloudNativePG instead of hand-rolled migrations
GitOps closed the diff-review gap for manifests and infrastructure, but most teams still change their database schema by hand. A look at Atlas's declarative approach: diff instead of a migration chain, a CI gate, and the AtlasSchema CRD on top of CloudNativePG.