DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
Velero: cluster backups to S3 and a restore rehearsal — DR you've actually rehearsed
Velero at its minimum: object and volume backups to S3 on a Schedule with TTL, CSI snapshots, and a monthly restore rehearsal into a clean namespace with a silence-based alert.
Keycloak in Kubernetes: one OIDC provider for kubectl, Argo CD and Grafana — self-hosted SSO
kubectl — client certificates, Argo CD — a local admin, Grafana — its own user database. Setting up Keycloak 26.8 in Kubernetes as the single OIDC provider: Postgres on CloudNativePG, kube-apiserver flags, kubelogin, groups from realm roles, realm-as-code, and an honest bill for the JVM.
VictoriaMetrics instead of Prometheus+Thanos: one binary instead of three — when it's honest savings
Long-term metric storage on Prometheus means Thanos: sidecar, store gateway, compactor and query on top of S3. Where VictoriaMetrics single-binary covers the same with one process: active-time-series thresholds, the vmagent/vmalert/vmbackup ecosystem, two migration paths, and RAM/disk numbers.
Crossplane 2.0 and the coming v1.20 EOL: cloud infrastructure via GitOps instead of Terraform state
Crossplane v1.20 hits EOL with the v2.5 release in November 2026 — the migration window is closing. What changed in 2.0: compositions from any Kubernetes resource, provider functions instead of monolithic providers, delivery through Argo CD — and an honest answer to when Crossplane is not for you.