Kubernetes, GitOps, CI/CD, Infrastructure as Code (IaC), and Site Reliability Engineering topics from seven years of production deployments.
Deploy Consul as OpenTofu Backend with Azure & Ansible In this blog post, we provide the necessary steps to setup a single-node standalone Consul server to be used as TF state backend. In doing so, we aim to provide idempotent and reproducible codes using Tofu and Ansible, for the sake of disaster recovery as well as enabling team collaboration within version control system.
Deploy Static Sites to Azure CDN with GitHub Actions OIDC In this blog post you will learn how to authenticate and deploy your frontend code to Azure CDN, backed by Azure Blob Storage to deliver low-latency static website to your users. The objective is to avoid hard-coded credentials and only employ OpenID Connect to establish trust relationship between the Identity Provider (GitHub) and the…
Cloud-Native Secret Management: OIDC in K8s Explained External Secrets is the de-facto choice for secrets management in Kubernetes clusters. It simplifies the task of the administrator(s) of the cluster, ensuring only the secrets that are explicitly defined are present and accessible. It comes with many great features but most important than all is its integration with major cloud providers. In…
Migration From Promtail to Alloy: The What, the Why, and the How Promtail is (was) the lightweight log collector solution that sends the log over the HTTP to the remote backend. This remote backend is normally Loki but you can choose to send the logs to VictoriaLogs as well. In this blog post, you will see the newer alternative to Promtail, Grafana Alloy. You will see what it is, why it's a good…
How to Setup Preview Environments with FluxCD in Kubernetes Preview environment is where you see a live state of your changes from your pull request before being merged into the default branch. It gives you a look'n feel of what it would be like if you merged your changes. Kubernetes on the other hand, is what powers the production setups. But that's not all it can do for you. I have spun up…
3 Ways to Time Kubernetes Job Duration for Better DevOps Knowing how long the exucution of jobs take is a crucial part of monitoring and proactive system administration. Being able to measure, store and query this value over the course of your application lifecycle can help you identify bottlenecks, optimize your infrastructure and improve the overall performance of your application. In this blog…
Ente: Self Host the Google Photos Alternative and Own Your Privacy In the recent few years, I keep seeing people being more aware of their privacy and taking it into their own hands. More and more solutions are emerging through the community that address the critical part of our society and personal life; privacy! In this blog post, I will introduce you to Ente, the Google Photos alternative. You…
How to Deploy Static Site to GCP CDN with GitHub Actions Building and deploying static sites is rarely an issue these days. Most of the PaaS providers already have full support for your live and your preview environments and a clean integration with your favorite Git provider. However, some organizations may choose to stick with big players like GCP for various reasons. In this blog post, you will…
How to Publish to GitHub Pages From Another Repository In this blog post, you will learn how to leverage GitHub Actions to deploy static files to the GitHub Pages of another repository. This can be useful if you keep your source code in a private repository, but also, you may find additional reasons to need this setup. Stick around till the end to find out how to do this with OpenTofu.
How to Provision a Production-Ready Autopilot GKE Cluster In this blog post I share my opinioated version of provisioning a Kubernetes cluster in the Google Cloud Platform (GCP) using nothing but Opentofu. The principles discussed here are the ones I have learned while dealing with production setups at the same scale. If you enjoy Kubernetes or want to learn more about GCP, this is for you.
Packer: How to Build NixOS 24 Snapshot on Hetzner Cloud Packer is a powerful tool to create immutable images, with support for various cloud providers. In this blog post, I share how I built a NixOS 24 snapshot using Packer on Hetzner Cloud. If you're a fan of NixOS or want to learn more about Packer, this post is for you.
How to Create Your Ansible Dynamic Inventory for AWS Cloud Most of the modern software deployment these days benefit from containerization and Kubernetes as the de-facto orchestration platform. However, occasionally, I find myself in need of some Ansible provisioning and configuration management. In this blog post, I will share how to create Ansible dynamic inventory in a way that avoids the need…
How to Protect ANY Upstream Service with Operational Authentication In this blog post, I will demonstrate how to use Ory Oathkeeper and Ory Kratos to protect upstream services behind authentication, especially the ones that do not have native authentication built-in, e.g., Prometheus, Hubble UI, Alertmanager, etc.
How to Deploy NodeJS to AWS Lambda with OpenTofu & GitHub Actions If you're a software engineer in any tier, there's a good chance that you're already familiar with the language and syntax of JavaScript. It has a very low barrier for entry and that is one of its strongest suits and what makes it so widely adopted and popular. In this article, you'll learn how to deploy a JavaScript application to…
Azure Bastion Host: Secure Cloud Access Made Simple Discover how Azure Bastion can revolutionize your cloud security strategy. This comprehensive guide explains what a Bastion host is, why it's crucial for secure access to your Azure resources, and provides a step-by-step walkthrough for implementation. You'll learn how to enhance your network security, simplify remote access, and automate Bastion…
Supercharge Monorepo CI/CD: Unlock Selective Builds Monorepo is the practice of storing all your code in a single repository, which can be beneficial for code sharing, dependency management, and version control. However, there is no free lunch! As your codebase grows, managing builds become unavoidably complex and time-consuming. This build time is billed on your organization and it can get quite…
Ory Keto: Authorization and Access Control as a Service Internet has come a long way since its inception. The first few years might have been a new adventure for those building web applications, but in the modern day software development and in 2024, you rarely stop to question most of the common practices around the industry. One of the most frequent requirement for any application is to have…
How to Set Up Preview Environments for Pull Requests Have you ever been frustrated at long merge queues? Did you ever wish there was a better and faster way to get feedback on your code changes and approval from your team members? You may have also been on the other side of the table, reviewing pull requests and wishing there was a better way to actually test the revisions before approving it;…
Unlocking the Power of VictoriaMetrics: A Prometheus Alternative One of the main tasks of an operations team in any organization is to provide a solid and robust monitoring solution for the platform, the application, and the entire infrastructure. Monitoring enables business owners to understand how their applications behave in a production setup, how to optimize it, and how to proactively…
Ory Oathkeeper: Identity and Access Proxy Server Ory has a great ecosystem of products when it comes to authentication and authorization. Ory Oathkeeper is an stateless Identity and Access Proxy server. It is capable of acting as a reverse-proxy as well as a decision maker and policy enforcer for other proxy servers. In today's application development world, if you're operating on HTTP layer, Ory…