Archive
Writing
Everything, newest first. Short and specific, drawn from real work.Subscribe via RSS.
OTel agent to Datadog: logs without the Datadog agent
Shipping logs to Datadog through an OpenTelemetry Collector: the exporter config, the batching that causes 413s, the hostname bug that restarts your pods, and keeping the bill in your control.
OTel agent to Loki: logs without a log shipper
The Loki exporter is gone from the Collector. What replaced it, how OTLP attributes become Loki labels, and the two limits that will reject your logs in production.
Monitoring setup for PySpark applications
Spark applications are ephemeral, so the usual scrape model does not fit. Wiring the Prometheus servlet, catching the Python memory that JVM metrics never show, and keeping evidence after the driver exits.
Monitoring setup for Airflow
Airflow 3 emits metrics through StatsD or OpenTelemetry, and the choice changes your Prometheus config. The pipeline, the metrics that predict failures, and the alerts worth paging on.
OpenCost: getting started with Kubernetes cost allocation
Per-namespace, per-workload cost from metrics you already collect. Installing it against an existing Prometheus, what it actually measures, and the number everyone argues about.
Using Envoy Gateway
A Gateway API implementation built on Envoy Proxy: how the pieces fit, what the policy CRDs are for, and where you still end up reaching for raw Envoy config.
Auto-PRs: the GitOps agent that keeps product repos in sync
A small agent watches platform releases and opens pull requests into every product team's DevOps repo, so upgrades propagate consistently, but teams still hold the merge.
Annotation translation: NGINX Ingress to Envoy Gateway
A working map from ingress-nginx annotations to Gateway API resources and Envoy Gateway policies. Including the ones that have no equivalent and need a decision instead.
Terraform vs Crossplane
Not a competition so much as two different answers to "when does infrastructure converge". Where each one fits, and why most platform teams end up running both.
Switching from Ingress to Gateway API in Kubernetes
Gateway API is not a new spelling of Ingress. What actually changed, why the role split matters more than the syntax, and a migration path that does not need a cutover weekend.
Kyverno: getting started with standard policies
Policy as Kubernetes resources: the four rule types, a starter set worth running in any cluster, and how to roll enforcement out without blocking every team on day one.
Checkov: getting started with standard policies
Static analysis for infrastructure as code: wiring it into CI without drowning in findings, plus baselines, suppressions, and custom policies that catch what the defaults miss.
Trivy: getting started with standard policies
One scanner for images, filesystems, IaC, secrets and live clusters. How to configure it so the results are actionable instead of a wall of unfixable CVEs.
Static analysis for DevSecOps: what to cover and what to use
Six distinct classes of static analysis, the open-source tool for each, and where in the pipeline to run it so the results get acted on rather than ignored.
OpenTelemetry with Jaeger
Instrumentation, the Collector, and tail sampling. How the pieces fit for distributed tracing on Kubernetes, and the two things that decide whether traces are actually useful.
Grafana + Prometheus: Kubernetes monitoring that earns its keep
kube-prometheus-stack, the Operator CRDs, and how to build alerts people act on instead of a wall of dashboards nobody opens.
High availability for Kubernetes deployments: the practices that matter
PDBs, topology spread, HPA, probes and graceful shutdown, which of them actually prevent downtime, and the misconfigurations that quietly cancel each other out.
No posts in that category yet.