DevOps&SRE Library

chartpack

A single, opinionated Helm chart for deploying any Kubernetes application workload. Instead of maintaining separate charts per application, define your entire deployment through values.

https://github.com/cotzo/chartpack

kubebuilder

Kubebuilder is a framework for building Kubernetes APIs using custom resource definitions (CRDs).

https://github.com/kubernetes-sigs/kubebuilder

pii-shield

Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks (GDPR/SOC2) by redacting PII from logs before they leave the pod.

https://github.com/aragossa/pii-shield

LLMs on Kubernetes: The Easy Way

Sometimes, you just want to run a Large Language Model (LLM)… no Jupyter notebook, no training pipeline, no fancy UI.

https://pittar.medium.com/llms-on-kubernetes-the-easy-way-f1ff6e0d47be

Orchestrating Secure AI Agents on Amazon EKS

How we went from scaling video analysis on EKS to running autonomous coding agents in a custom agent harness, and why Kubernetes was the obvious choice.

https://dev.to/mattcamp/orchestrating-secure-ai-agents-on-amazon-eks-50kh

What 6 Months of Tracking a Production OpenShift Cluster Revealed About Kubernetes Costs

Most Kubernetes teams track pod CPU and memory. Almost none track what the cluster actually costs to run.

https://blog.kubeledger.io/what-6-months-of-tracking-a-production-openshift-cluster-revealed-about-kubernetes-costs

Running Temporal.io on Kubernetes in Production — What Nobody Tells You

A practical guide to GKE deployment, Cassandra backups, Istio security, and surviving your first outage

https://medium.com/@devansh2054/running-temporal-io-on-kubernetes-in-production-what-nobody-tells-you-d1f336e99306

We built a self-healing registry mirror (because Docker Hub rate limits are no fun)

If you've ever stared at `ImagePullBackOff` in your cluster at 2 PM on a Tuesday, you know — Docker Hub rate limits hit, your pods can't pull, and a perfectly fine deployment is stuck.

https://tinysystems.io/blog/registry-mirror-automation

pgBackRest is dead. Now what?

I have been recommending pgBackRest as the best backup tool for PostgreSQL for years.

https://mydbanotebook.org/posts/pgbackrest-is-dead.-now-what

waffle

Waffle is a CLI utility that automates AWS Well-Architected Framework Reviews by analyzing Terraform infrastructure using Amazon Bedrock foundation models via direct API invocation in AWS. The Well-Architected Framework questions are then being analyzed by Amazon Bedrock and answered and posted directly to the Well-Architected tool in AWS.

https://github.com/partly-notes/waffle

🎥 Вебинар: «Организуем CD с помощью Ansible и GitLab CI» О чём поговорим: - Как организовать автоматизированный процесс деплоя с помощью GitLab CI и Ansible. - Как использовать Ansible Playbooks и Roles для управления инфраструктурой. - Лучшие практики по обновлению сервисов без даунтайма и обработке ошибок. Что вы получите: - Вы освоите автоматизацию CD-процессов с Ansible и GitLab CI. - Сможете разрабатывать гибкие и безопасные пайплайны для деплоя в разных окружениях. - Поймёте, как уменьшить риск ошибок при развертывании и минимизировать время простоя сервисов. - Научитесь управлять конфигурациями инфраструктуры без лишней ручной работы. 👉 Для участия зарегистрируйтесь: https://vk.cc/cXAbo1 🎁 Все участники вебинара получат специальные условия на полное обучение курса «DevOps практики и инструменты» Реклама. ООО «Отус онлайн-образование», ОГРН 1177746618576, www.otus.ru, erid: 2VtzqxMNiF9

Terraform is dead

The more I look at how we actually build systems now, the more it looks like Terraform is dead.

https://grahamgilbert.com/blog/2026/04/20/terraform-is-dead

👩‍💻 Всех DevOps-ов и не только с пятницей! Подготовили для вас подборку полезных TUI для Kubernetes, Docker и etcd. DockMate – ранее DockWatch, легковесный терминал, который позволяет отслеживать производительность в Docker и Podman Compose. Работает как альтернатива LazyDocker на языке Go. С его помощью можно получить полный контроль над работой в контейнерах, доступ к метрикам мониторинга и метаданным панели. kubetui – интуитивный инструмент для отслеживания ресурсов Kubernetes в реальном времени. Даёт доступ к информации о подах и их логах в контейнере, настроенный мониторинг секретов и ConfigMap, отслеживание событий, упрощает работу с контекстом. etcd-walker – приложение, которое позволяет работать с etcd хранилищем «ключ-значение» как с системой файлов. Создавайте, удаляйте, экспортируйте ключи и директории через единый интерфейс с поддержкой всех версий etcd, аутентификацией и TLS. 🤩 Кстати, напоминаем о полезном инструменте от нас: 🟡nxs-universal-chart v3.0.7 – модульная платформа для Kubernetes и платформенной поставки приложений, а о том как развернуть полностью готовый Inference контур рассказали на Хабре. #девопс #tui #opensource Реклама. ООО «Никсис», ИНН: 5407461244, erid: 2Vtzqx3TURM

The Dao of Terraform Modules: Design and Governance Strategies for High-Quality Terraform Modules https://lonegunmanb.github.io/dao-of-terraform-modules-book-english

boring

A simple command line SSH tunnel manager that just works.

https://github.com/alebeck/boring

PGKeeper: Building the bouncer we needed for Postgres

This is the story of why and how we built PGKeeper, a scalable and reliable service to support Figma’s rapidly growing products and database workload.

https://www.figma.com/blog/pgkeeper-building-the-bouncer-we-needed-for-postgres

deepsec

deepsec an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos.

https://github.com/vercel-labs/deepsec

honker

honker is a SQLite extension + language bindings that add Postgres-style NOTIFY/LISTEN semantics to SQLite, with built-in durable pub/sub, task queue, and event streams, without client polling or a daemon/broker. Any language that can SELECT load_extension('honker') gets the same features.

https://github.com/russellromney/honker

How We Reduced Median Memory Estimation Error by 99%, With the Help of AI

When you're running a system that processes hundreds of thousands of compaction jobs, even small inaccuracies in memory usage estimates compound into real operational pain.

https://mixpanel.substack.com/p/how-we-reduced-median-memory-estimation

When upserts don't update but still write: Debugging Postgres performance at scale

At Datadog, we track the life cycle of millions of ephemeral hosts that report telemetry data to our platform. When a host stops emitting data, we eventually need to clean it up to avoid bloating our metadata store. To detect inactive hosts, the Datadog team that manages the host metadata store introduced a new upsert to track the last time a host was seen. We expected this new query to have minimal impact. Each host would be updated at most once a day, so even at 25,000 upserts per second, most queries should have been no-ops. But when we rolled out the new query, disk writes doubled and Write-Ahead Logging (WAL) syncs quadrupled. We discovered that even when an upsert doesn't change any values, it still locks the conflicting row, which is recorded in the WAL. Given that a Postgres cluster can only have a single writer, there's a hard limit to how many writes it can handle. The increase in disk writes introduced by the new query was consuming too much of this limited budget and had to be fixed. In this post, we'll walk through how we diagnosed the unexpected overhead by inspecting Postgres's WAL and how we rewrote the query to eliminate the cost without sacrificing correctness.

https://www.datadoghq.com/blog/engineering/debugging-postgres-performance