DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
OpenTofu: state encryption and leaving Terraform without drama
OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.
-
Istio ambient: a service mesh without sidecars
Istio's ambient mode reached GA and removes the main argument against service mesh — a sidecar in every pod. We cover the ztunnel + waypoint architecture, mTLS without restarts, and rolling out L7 only where it's needed.
-
Karpenter: just-in-time nodes and half the cluster bill
Cluster Autoscaler scales pre-sized node groups, Karpenter picks the right instance for the actual pending pods and collapses the cluster when idle. NodePool/NodeClass, consolidation, spot fallback, and the traps that block it — with a working manifest.
-
External Secrets Operator: Vault secrets in Kubernetes without copy-paste
External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.