Kubernetes Cost Optimization: Finding the Idle Half of Your Cluster
Most clusters run 30-50% idle because requests don't match reality. A practical walkthrough of requests vs usage, OpenCost, right-sizing, and spot nodes.
Read the postCategory: <span>Uncategorized</span>
Image Scanning + Admission Control: Stop Vulnerable Images
How to scan container images with Trivy or Grype and enforce results with Kyverno or Gatekeeper admission policies, plus an exception workflow that won't get abused.
Read the postKubernetes Audit Logs: Finding the Needle Before the Incident
How to tune Kubernetes audit policy, what to actually alert on, and how to keep log volume from eating your budget. Practical audit logging for platform teams.
Read the postPod Security Standards: Getting to restricted Without a Revolt
A field-tested rollout plan for Pod Security Standards: audit mode first, baseline before restricted, and exemptions that don't become permanent.
Read the postRBAC Least Privilege: Designing Roles People Can Live With
Practical Kubernetes RBAC design: namespaced Roles over ClusterRoles, aggregated clusterroles for teams, killing wildcard verbs, and audits people actually run.
Read the postService Account Tokens: The Quiet Security Hole in Every Cluster
Service account tokens are mounted into every pod by default. Here's how automountServiceAccountToken, bound tokens, and workload identity close the hole.
Read the postSupply Chain Security: Sigstore, SLSA, and What’s Actually Practical
A pragmatic take on supply chain security: cosign keyless signing, signature verification at admission, SBOMs that get used, and SLSA without ceremony.
Read the postetcd Backup and Restore: The Drill Nobody Practices
Everyone takes etcd snapshots; nobody restores one until it's life or death. Snapshots, quorum loss, and the restore procedure you should drill quarterly.
Read the postPVs, PVCs, and StorageClasses: The Mental Model That Finally Clicked
PVs, PVCs, and StorageClasses explained the way I wish someone had explained them to me: provisioning, reclaim policies, and expansion, minus the confusion.
Read the postRunning Postgres on Kubernetes: Operators Make It Sane
Postgres on Kubernetes doesn't have to be scary. How operators like CloudNativePG handle failover, backups, and upgrades, and why the objections are dated.
Read the post