DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
OBI: zero-code application tracing via eBPF, the Grafana Beyla successor
OpenTelemetry eBPF Instrumentation (OBI) traces HTTP/gRPC/SQL straight from the kernel — no in-container agent, no line of application code touched. We look at how OBI differs from Hubble, Tetragon and Pyroscope, how it plugs into an OTel Collector you already run, and where zero-code instrumentation hits its ceiling.
-
OpenCost: cost-allocating a Kubernetes cluster down to the namespace
OpenCost is a CNCF project that allocates Kubernetes cost by namespace, deployment, and label — no commercial subscription required. We cover the allocation model, how it differs from Kubecost after IBM's acquisition, and how to install it next to a Prometheus you already run.
-
SPIFFE/SPIRE: cryptographic workload identity instead of static secrets
SPIFFE standardizes workload identity through short-lived SVID certificates, and SPIRE — its reference implementation — issues and rotates them via two-tier attestation (node + workload) with no pre-shared secret anywhere. We break down how it differs from external-secrets-operator, how federation works across clusters, and deploy SPIRE to fetch a real X.509-SVID for a test pod.
-
SpinKube: running WebAssembly workloads on Kubernetes without a custom runtime
SpinKube schedules WebAssembly modules as regular pods — the same kubectl apply, the same HPA, but startup in single-digit milliseconds with no container warm-up. We break down the containerd-shim-spin architecture, install the SpinKube operator, deploy a SpinApp next to a regular Deployment and measure the difference — while being honest about which workloads WASM still isn't a fit for.