Helm vs Kustomize: An Honest Take From Both Sides
Helm vs Kustomize without the tribalism: templating vs overlays, release management vs GitOps, drift behavior, and how I use both on the same cluster.
Read the postconndeck blog
Writing about local-first Kubernetes operations: security posture, fleet drift, GUI plus TUI workflows, and verifiable releases. No telemetry, no login, no data leaves your device.
Promoting Between Environments in GitOps Without Losing Your Mind
How to promote from staging to prod in GitOps: repo layouts, Kustomize overlays, image tag promotion via PR, and the habits that prevent drift.
Read the postExternal Secrets Operator: Stop Committing Secrets
Why encrypted secrets in git still lose, and how to wire External Secrets Operator to Vault or a cloud secret manager with rotation that actually works.
Read the postArgoCD vs Flux: After Running Both in Production
An honest ArgoCD vs Flux comparison from someone who ran both in production: install, day-two ops, multi-tenancy, drift handling, and which one I'd pick when.
Read the postArgo Rollouts: Canary Deploys Without a Platform Team
A practitioner's guide to Argo Rollouts: canary steps, AnalysisTemplates with Prometheus metrics, aborts and rollbacks, and the gotchas that bite small teams.
Read the postRequests and Limits: Stop Copying Numbers From Stack Overflow
Requests and limits drive scheduling, throttling, and OOM kills. A practical guide to measuring real usage, the CPU limits debate, and right-sizing with data.
Read the postPodDisruptionBudgets: The Availability Feature Everyone Skips
PodDisruptionBudgets control how many pods voluntary disruptions can take down. Drain behavior, minAvailable vs maxUnavailable, and PDBs that block upgrades.
Read the postLimitRange and ResourceQuota: Namespace Guardrails That Actually Work
LimitRange sets per-container defaults and bounds; ResourceQuota caps namespace totals. How they interact, the gotchas, and configs that hold up in production.
Read the postQoS Classes: Guaranteed, Burstable, and Who Gets Evicted First
Kubernetes assigns every pod a QoS class: Guaranteed, Burstable, or BestEffort. How the classes are computed and how they decide eviction order under node pressure.
Read the postHPA, VPA, KEDA: Which Autoscaler Does What
HPA scales replicas on metrics, VPA right-sizes requests, KEDA scales on external events. How they differ, how they conflict, and how to combine them safely.
Read the postWhy Your Cluster Autoscaler Isn’t Scaling
Pods Pending, cluster autoscaler doing nothing? The usual causes: PDBs, node group limits, taints, labels, and resource requests no node can satisfy.
Read the postClusterIP, NodePort, LoadBalancer: What You’re Actually Buying
ClusterIP vs NodePort vs LoadBalancer explained by someone who's paid the bills: what each service type actually creates, how kube-proxy routes it, and when to use which.
Read the post