DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
Database schema as code: Atlas on top of CloudNativePG instead of hand-rolled migrations
GitOps closed the diff-review gap for manifests and infrastructure, but most teams still change their database schema by hand. A look at Atlas's declarative approach: diff instead of a migration chain, a CI gate, and the AtlasSchema CRD on top of CloudNativePG.
-
Guardrails for AI SRE agents: automating remediation without losing control
AWS DevOps Agent and Azure SRE Agent have been GA since March 2026, and neither pushes production changes without human confirmation. Here's how to design an approval gate on top of your own incident pipeline: three levels of autonomy, a narrow executor instead of direct cluster access for the agent, and what to log for audit.
-
Sidecar-free service mesh: Cilium Service Mesh next to Istio Ambient
Cilium Service Mesh handles mTLS and L7 routing on the eBPF datapath with no separate proxy components at all — unlike Istio Ambient, which drops the sidecar but keeps ztunnel and waypoint. We compare the architectures, the honest limitations, and turn on mTLS in a cluster that already runs Hubble.
-
Flux 2.8: CEL-based health checks and what they change for release gating
Flux 2.8 adds healthCheckExprs — CEL expressions for health checks in Kustomization and HelmRelease. We cover the syntax, migrating an existing resource, and how it differs from canary checks in Argo Rollouts/Flagger.