DevOps&SRE Library

Kubernetes Optimization Beyond Requests and Limits — Node Scaling Blockers

Stop paying for idle resources. Learn to identify and eliminate the hidden blockers preventing your cluster from scaling down.

https://medium.com/@david.b.chase/kubernetes-optimization-beyond-requests-and-limits-node-scaling-blockers-649ae187f54a

In-Place PVC Re-Binding: Zero-Downtime Disk Migration on Kubernetes

Standard migration paths require downtime. At our scale, taking hundreds of disks (backing data stores like ClickHouse, CockroachDB, Kafka, Prometheus) offline was off limits. This blog introduces an in-place PVC re-binding technique that swaps a PersistentVolumeClaim's backing PersistentVolume while keeping the underlying disk intact. It requires only a single pod restart per volume, done entirely using the Kubernetes API natively with no custom software or control plane hacks.

https://blog.cleancompute.net/p/pvc-re-binding

Exploring ListenerSets in Gateway API v1.5

With the retirement of ingress-nginx I've seen a lot of frustrations with Gateway API migrations due to differences in some of the resource models. The common problem is that Ingress users are often running self-service models, where application teams fully own their ingress configuration, including TLS certificates.

https://blog.howardjohn.info/posts/listenerset

Benchmarking Kubernetes Log Collectors: vlagent, Vector, Fluent Bit, OpenTelemetry Collector, and more

At VictoriaMetrics, we built vlagent as a high-performance log collector for VictoriaLogs. To validate its performance and correctness under a real production-like load, we developed a benchmark suite and ran it against 8 popular log collectors. This post covers the methodology, throughput results, resource usage, and delivery correctness.

https://victoriametrics.com/blog/log-collectors-benchmark-2026/index.html

nodecore

A fault-tolerant, API-agnostic RPC load balancer for blockchain APIs.

https://github.com/drpcorg/nodecore

The Complete OpenSSL & TLS Debugging Guide: From Root CA to Kubernetes

A practical, production-ready cheat sheet to understand certificates, fix TLS handshake errors and debug real-world issues using OpenSSL, curl and Kubernetes.

https://medium.com/@amolsingh.singh23/the-complete-openssl-tls-debugging-guide-from-root-ca-to-kubernetes-b0d9f9dfcda3

Running Production Minded Kubernetes on a Raspberry Pi

This cluster runs on a Raspberry Pi 3, inside a normal household network, behind an ISP router that cannot be replaced. The goal was not to build a "homelab". The goal was to design a small, portable, security-focused platform using the same principles I would apply in a professional environment.

https://medium.com/@razeen.abdal-rahman/running-production-minded-kubernetes-on-a-raspberry-pi-81aa0ae6687f

Handling Leaked Secrets and Credentials in Version Control Repositories

We have all been there. You are pushing a hotfix at midnight, you forget to remove a test API key you hardcoded during debugging, and it ends up in the main branch. Secrets leaking into version control is one of the most common and costly security mistakes in software development.

https://medium.com/@mgaurang123/handling-leaked-secrets-and-credentials-in-version-control-repositories-e11149b8a8b9

Building Secure GitOps Pipelines: Integrating External Secrets Operator with ArgoCD on EKS

When deploying applications to Kubernetes, one of the first security concerns that arises is secret management. This article chronicles my journey of migrating a Grafana admin password from a hardcoded Helm value to AWS Systems Manager Parameter Store using the External Secrets Operator.

https://blog.devops.dev/building-secure-gitops-pipelines-integrating-external-secrets-operator-with-argocd-on-eks-8149f363aa15

Десять CLI, SDK и Terraform-провайдеров — из одной OpenAPI-спецификации? 21 июля в 17:00 в новом выпуске реалити-проекта «Создавая облако» от MWS Cloud Platform технический руководитель платформы Дмитрий Новиков покажет, как устроена внутренняя кухня автоматизации облака. Что будет в эфире: • тотальный dogfooding: почему внутренние команды работают теми же инструментами, что и клиенты; • как устроен декларативный API: манифест → reconcile → desired state; • пять инструментов автоматизации — UI, CLI, Terraform, Golang SDK и Packer, — зачем нужен каждый; • как один кодогенератор из единой спецификации кормит десять артефактов; • почему Packer остаётся осознанным исключением и пишется руками. Выпуск будет интересен backend-разработчикам, DevOps- и SRE-инженерам, platform-инженерам, техническим лидам и архитекторам. ➡ Зарегистрироваться

Running PostgreSQL on Kubernetes: Operators, Storage and Production Guide

The "should I run databases on Kubernetes?" debate is over. Zalando runs 4,000+ PostgreSQL clusters on Kubernetes. Bloomberg, Apple, and dozens of CNCF end-user companies do the same. The question is no longer whether it works — it is whether your team should do it, and if so, how to do it without losing data or sleep.

https://dev.to/philip_mcclarence_2ef9475/running-postgresql-on-kubernetes-operators-storage-and-production-guide-54ii

Migrating Ingress NGINX Controller to Istio in Kubernetes environment

Many Kubernetes environments rely on ingress-nginx as the primary entry point for external traffic. With the retirement of Ingress-NGINX in our environment, we needed to migrate to a new ingress solution. Instead of replacing it with another traditional ingress controller, we chose to adopt Istio and explore its service mesh–based traffic management capabilities.

https://medium.com/@bharat.kalra244/migrating-ingress-nginx-controller-to-istio-in-kubernetes-environment-cb2f23790ea0

😀От GitOps до инцидентов: первые доклады DevOops 2026 В инфраструктуре редко бывает «просто настроить и забыть», и чем сложнее системы, тем больше инженерных решений приходится принимать каждый день. Именно об этом мы и будем говорить на DevOops 2026. 🗓12–13 октября, Санкт-Петербург + online Первые доклады опубликованы. В них — истории команд о том, как они автоматизируют процессы, масштабируют инфраструктуру, работают с Kubernetes и GitOps и готовятся к неожиданным сбоям. Подробности в карточках и на сайте. Новые доклады будут появляться каждую неделю, так что следите за обновлениями программы. А чтобы не пропустить новости, подпишитесь на нашу рассылку. До встречи на DevOops 2026!

khook

One static binary that takes a freshly created cluster from "API server answers" to "workloads can be deployed" — a declarative, idempotent DAG of helm, apply, wait, and friends. No kubectl, no helm binary, no bash.

https://github.com/dvrkn/khook

Why I built ctx_: the context switcher that actually gets DevOps work

ctx treats your entire DevOps environment as a single switchable context. kubectx is great for what it does, but it only solves one piece of the puzzle: Kubernetes contexts. What about AWS/GCP/Azure credentials, SSH tunnels to databases, VPN connections, environment variables, Vault tokens, Git user configs, and browser profiles for SSO?

https://dev.to/vlebo/why-i-built-ctx-the-context-switcher-that-actually-gets-devops-work-3059

Before You Migrate: Five Surprising Ingress-NGINX Behaviors You Need to Know

As announced November 2025, Kubernetes will retire Ingress-NGINX in March 2026. Despite its widespread usage, Ingress-NGINX is full of surprising defaults and side effects that are probably present in your cluster today. This blog highlights these behaviors so that you can migrate away safely and make a conscious decision about which behaviors to keep. This post also compares Ingress-NGINX with Gateway API and shows you how to preserve Ingress-NGINX behavior in Gateway API. The recurring risk pattern in every section is the same: a seemingly correct translation can still cause outages if it does not consider Ingress-NGINX's quirks.

https://kubernetes.io/blog/2026/02/27/ingress-nginx-before-you-migrate

⚠️Узнайте, как выстраивать диалог с бизнесом и перестанете быть просто «главным инженером» на курсе «Технический директор / CTO» 🎁Записывайтесь на 3 бесплатных вебинара — познакомьтесь с программой обучения и преподавателями. Задайте свои вопросы экспертам! 🔸Вебинар 1: «Метрики CTO: как доказать бизнесу, что инженерная команда работает эффективно» ⏰8 июля в 20:00 мск Программа вебинара: 1. Как говорить с руководством, чтобы вас слышали 2. Основные метрики эффективности для команды 🔸Вебинар 2: «Как CTO говорить с бизнесом и командой на одном языке» ⏰16 июля в 20:00 мск Программа вебинара: 1. Выстраиваем общение со стейкхолдерами и командой 2. Переведём технические вопросы на язык целей, сроков и рисков 🔸Вебинар 3: «Как CTO управляет неопределённостью: оценки, планы и ожидания бизнеса» ⏰22 июля в 20:00 мск Программа вебинара: Разберём, как CTO оптимизировать культуру работы с неопределённостью: инструменты и шаблоны для работы без вашего постоянного контроля. Записывайтесь ➡️ OTUS.RU Реклама. ООО «Отус онлайн-образование», ОГРН 1177746618576, www.otus.ru, erid: 2VtzqvEB1nq

Three Weeks in the Trenches: Hunting a 4GB Native Memory Leak That .NET Couldn't See

Our ASP.NET Core pods on Kubernetes were OOM-killed every few hours during a pre-launch pilot. The managed heap was clean — 95% of the memory was native, invisible to every .NET diagnostic tool we threw at it.

https://medium.com/@kalyanjv/three-weeks-in-the-trenches-hunting-a-4gb-native-memory-leak-that-net-couldnt-see-0713935776d0

sealed-secrets-web

Sealed Secrets Web is a web interface for Sealed Secrets by Bitnami. The web interface let you encode, decode the keys in the data field of a secret, load existing Sealed Secrets and create Sealed Secrets. Under the hood it uses Sealed Secrets service API to encrypt your secrets. The web interface should be installed to your Kubernetes cluster, so your developers do not need access to your cluster via kubectl.

https://github.com/bakito/sealed-secrets-web

openrun

OpenRun is an Apache-2.0 licensed open source web app deployment platform for deploying internal tools. OpenRun makes it easy to declaratively deploy containerized web apps. OpenRun can deploy apps on a single-node or onto a Kubernetes cluster. OpenRun provides declarative GitOps based blue-green deployment, OAuth/OIDC/SAML access controls, TLS certs & secrets management. OpenRun is built for teams to easily deploy internal tools, with full RBAC support. OpenRun apps are deployed directly from the git repo, no build server required. OpenRun scales idles apps down to zero and supports atomic updates across multiple apps.

https://github.com/openrundev/openrun