Tag: devops

Upgrade k3s without dropping workloads: the cordon and drain sequence, then system-upgrade-controller Plans that automate it, with PDB and Longhorn gotchas.

Kyverno on k3s: validate, mutate, generate, verify signed images, handle exceptions, and test policies in CI. Plus the CEL policy types replacing ClusterPolicy.

Docker layer cache works on your laptop but CI starts cold. Fix it with registry cache or type=gha, set scope and mode=max, and debug why hits still miss.

A secret that reaches git push is already gone. Compare gitleaks, TruffleHog, and detect-secrets as pre-commit hooks, with working configs you can copy.

Turn a devcontainer into a team standard: Compose with Postgres, pinned Features, lifecycle hooks, one prebuilt image for laptops and CI, and the UID gotcha.

Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.

Cluster API turns k3s cluster lifecycle into YAML: create, scale, and upgrade whole clusters as code with a management cluster, no more one off scripts.

RabbitMQ vs NATS for a self-hosted app: routing, delivery guarantees, Docker Compose setups, Python code, and which broker to run for background jobs.

Master Helm templating sanity. Values files, smart defaults, when to skip Helm entirely, and why nested variables aren't always the answer.

A security audit of Garrul, my Cloudflare Workers comment system, found 2 critical bugs. Both had the same root cause as one I had already fixed in June.

A WordPress login bot burned 90% of my Cloudflare Workers free tier in two hours attacking a site that has never run PHP. Here's what actually stopped it.

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.