DevOps&SRE Library

How We Built a Data Warehouse Using ClickHouse

When the scripts that generate the data for letsencrypt.org/stats broke yet again, we decided to retire it rather than repair it. Let’s Encrypt issues six to ten million certificates each day, producing a large volume of logs that keeps growing. It became increasingly time-consuming and difficult to answer questions about our own issuance like “how many certificates use the ‘shortlived’ profile.” Using raw logs, this requires finding, parsing and extracting relevant portions of loglines. Querying the database behind our issuance API is not a practical option, as it’s built for transactions rather than analysis. We’d also used a log search SaaS product, but our bills were growing much faster than we’d like, and while it was fine for searching, it wasn’t able to do the analytic workloads we needed. We knew we could dream bigger and better.

https://letsencrypt.org/2026/09/17/clickhouse.html

git-bug

Distributed, offline-first bug tracker embedded in git

https://github.com/git-bug/git-bug

Библиотека практик: проактивная защита контейнеров 8 октября, 11:00 — стрим «Лаборатории Касперского» для тех, кто пишет и выкатывает сервисы в контейнерах. Возможности Kaspersky Container Security, обзор контейнерных угроз и экспертная дискуссии о лучших практиках работы с контейнерными инфраструктурами. Зарегистрироваться

ax

Declare an agentic task with workspaces and gateway specifications. AX sandboxes it, wires up its workspace, fences its network, and helps running it at scale. AX is a high-throughput, declarative orchestrator to run billions of autonomous agent workloads in a cluster. It runs on top of Agent Substrate for sandboxed execution and is built to run billions of tasks per cluster. If you have used Kubernetes, ax will feel similar.

https://github.com/google/ax

atlas

Atlas is source control for coding agents. Every agent run produces checkpoints: commits are linked back to the session that made it alongside the prompts, tool calls, and reasoning. You see which agent did exactly what and why. Run Claude Code, Codex, Atlas's own agent, or anything from the ACP registry side by side against the same codebase, with shared memory so switching agents mid-task doesn't mean starting over.

https://github.com/pacifio/atlas

gortex

High-performance code-intelligence engine for AI agents and IDE, supports 257 languages, multi repositories, based on graph, with access via CLI, MCP Server, and API. AI coding agents teammate - expose only needed information, cutting token usage up to 50x. 100% local.

https://github.com/zzet/gortex

drop

Linux sandboxing that doesn't get in your way

https://github.com/wrr/drop

rune

Rune is a fast, GPU-accelerated, full-featured IDE and terminal multiplexer, suitable both for automatic and manual programming.

https://github.com/unstablebuild/rune

Optimizing Kubernetes pod deployments for reliability with topology spread constraints

Pod distribution plays a much bigger role in reliability than you might think. By adding a few lines to your manifest, you can ensure your deployments are zone-redundant and evenly scalable. The feature is called topology spread constraints, and in this blog, we'll explain how it works in full detail.

https://www.gremlin.com/blog/optimizing-kubernetes-pod-deployments-for-reliability-with-topology-spread-constraints

How we tracked down a 16-year-old SQLite bug

At the end of last year, our uptime was pretty shaky. Many of these outages were caused by a single bug, deep in SQLite. It took months of intense forensics to track it down.

https://tailscale.com/blog/sqlite-wal-reset-bug

Type Conversion: What Changes (and What Doesn't) When You Start a New SRE Job

Pilots have a specific term for moving from one airplane to another: a "type conversion". Not "learning to fly" again — you already know how to fly. It's the process of taking everything you already know and re-mapping it onto a new machine that does the same job with a different cockpit. Starting a new SRE job is the same thing.

https://billduncan.org/type-conversion

Control and complexity: tension in systems design

In this post I want to discuss how we organize systems by contrasting two families of approaches. The first is about analytical decomposition that aims to maintain control over a system, and the other is based on a perspective of complex systems that resist analysis, which tend to focus on figuring out interactions and mechanisms to foster desirable emergent behaviour.

https://ferd.ca/control-and-complexity-tension-in-systems-design.html

Heroic saves are near misses

What doesn't usually happen is anyone asking: what if she hadn't been there? Because that heroic save, for all the heartfelt celebration around it, was actually a near miss from a systemic point of view.

https://greatcircle.com/blog/2026/07/21/heroic-saves-are-near-misses

k8s-overcommit Operator

The k8s-overcommit Operator is a Kubernetes operator designed to intelligently manage resource overcommit on pod resource requests. It automatically adjusts CPU and memory requests based on configurable overcommit classes, enabling better cluster resource utilization while maintaining workload performance.

https://github.com/InditexTech/k8s-overcommit-operator

kstack

Kstack is a skill pack for Claude Code that helps you perform monitoring, troubleshooting and auditing tasks on your K8s clusters in a smart and efficient way.

https://github.com/kubetail-org/kstack

Klarity

Klarity is an open-source, enterprise-grade Kubernetes observability dashboard built for teams that follow GitOps practices.

https://github.com/selvarajmurugesan90/klarity

✨ Как настроить PostgreSQL для продакшен-нагрузок

При переходе к продакшен-нагрузкам важно заранее продумать отказоустойчивость, сценарии переключения между узлами и поведение кластера при плановых работах и сбоях.

29 сентября эксперт Cloud․ru проведет вебинар о том, как обеспечить высокую доступность PostgreSQL в облаке. В программе:

▶как устроен отказоустойчивый кластер в Evolution Managed PostgreSQL ▶где проходит граница между высокой доступностью и аварийным восстановлением ▶какую роль играет Multi-AZ-архитектура ▶для каких задач используются реплики PostgreSQL ▶как работают ручное и автоматическое переключение ▶что важно учитывать при эксплуатации PostgreSQL в продакшене

Будет интересно всем, кто работает с PostgreSQL и отвечает за доступность баз данных и надежность инфраструктуры. Зарегистрироваться

IPMan - IPSec Connection Manager for Kubernetes

IPMan is a Kubernetes operator that simplifies the management of IPSec connections, enabling secure communication between your Kubernetes workloads and the outside world.

https://github.com/dialohq/ipman

Autoscalable GitLab runners on AWS EC2

This article shares our experience of getting rid of continuously running EC2 instances, setting up scalable GitLab Runners in AWS, and significantly cutting CI infrastructure costs.

https://palark.com/blog/autoscalable-gitlab-runners-on-aws-ec2

From Ingress to Gateway API: How We Modernized Networking on Our GKE Cluster

We recently migrated our production GKE cluster from the traditional Ingress controller to the Kubernetes Gateway API — and honestly, we should have done it sooner.

https://the-devops-engineer.medium.com/from-ingress-to-gateway-api-how-we-modernized-networking-on-our-gke-cluster-8409ffb53173