DevOps&SRE Library

celld

celld is an open-source daemon that runs Cloudflare Workers and Durable Objects on your own machines. Each object is its own SQLite database. celld addresses an object by name and replicates it to a bucket that you own. The bucket can be S3-compatible or Google Cloud Storage. The nodes coordinate through that bucket alone, with no control plane and no consensus. Because every object is its own small database, applications shard by construction — the contention and blast-radius failures of one shared database are designed out, not managed. A cell that no node holds is inactive, and an inactive cell costs nearly nothing.

https://github.com/denoland/celld

git-knife

Stab your git history into shape — every commit's message, author, and dates, edited like a table.

https://github.com/TheRealYT/git-knife

We replaced Redis with MySQL for inventory reservations—and it scaled

How we used SKIP LOCKED, composite primary keys, and connection visibility to hit our scale targets.

https://shopify.engineering/scaling-inventory-reservations

lfk

LFK is a keyboard-focused, yazi-inspired terminal user interface for navigating and managing Kubernetes clusters. It brings a three-column Miller columns layout with an owner-based resource hierarchy to your terminal.

https://github.com/janosmiko/lfk

aicr

AI Cluster Runtime (AICR) makes it easy to stand up GPU-accelerated Kubernetes clusters. It captures known-good combinations of drivers, operators, kernels, and system configurations and publishes them as version-locked recipes — reproducible artifacts for Helm, Argo CD, Flux, and Helmfile.

https://github.com/NVIDIA/aicr

fulling

Fulling is building dedicated AI workspaces: persistent environments that combine skills, files, memory, scripts, and runtime.

https://github.com/FullAgent/fulling

piqc

piqc is a source-available inference fact collector for Kubernetes clusters. It collects model-aware facts — what is running, on what hardware, at what cost, with what waste — and surfaces them as a standardized facts bundle that feeds an optimization layer.

https://github.com/paralleliq/piqc

Docker Image Signing and Verification

This document provides a step-by-step guide to signing Docker images stored in Amazon ECR using Cosign and AWS KMS, enabling secure software supply chain practices in Kubernetes (EKS) environments.

https://awstip.com/docker-image-signing-and-verification-2d2916f8129e

Making and Scaling a Game Server in Kubernetes using Agones

Agones is a project created by Google to manage and deploy video game servers on Kubernetes.

https://noe-t.dev/posts/making-and-scaling-a-game-server-in-k8s-using-agones

GitOps with Terraform using tofu-controller: Grafana and Hashicorp Vault as Code

In this article, we'll show how to use tofu-controller to manage Terraform resources using GitOps, focusing on two real-world use cases: managing Grafana resources (dashboards, datasources, folders, alert rules) and managing HashiCorp Vault resources (policies, auth methods, roles).

https://medium.com/@rodrigoscaldas/gitops-with-terraform-using-tofu-controller-grafana-and-hashicorp-vault-as-code-0a17073dfbcc

How We Set Up One Private Container Registry for 6 AKS Clusters Across 3 Regions and What Broke Along the Way

This post walks through how we architected a single private container registry accessible by all six of our AKS clusters across three Azure regions. I'll cover what worked, what silently failed for weeks before we noticed, and the decisions I'd make differently today.

https://dev.to/alex_coder19283/how-we-set-up-one-private-container-registry-for-6-aks-clusters-across-3-regions-and-what-broke-5h1j

We Tested Copy Fail in Kubernetes: PSS Restricted and RuntimeDefault Did Not Block AF_ALG

On April 22, 2026, the Linux CNA published CVE-2026-31431, a Linux kernel vulnerability in algif_aead, the AEAD side of the kernel's AF_ALG crypto socket interface. Xint named the bug Copy Fail and showed how page-cache bytes for a read-only file can be changed without dirtying the file on disk.

https://juliet.sh/blog/we-tested-copy-fail-in-kubernetes-pss-restricted-runtime-default-af-alg

Для тех, кто работает с Kubernetes и облачной инфраструктурой, в октябре намечается отличный повод выбраться из рабочих чатов и встретиться офлайн 👀 Что будем обсуждать: – AI и облачную инфраструктуру; – экономику платформ и безопасность в эпоху LLM; – эксплуатацию Kubernetes и observability; – сети и Service Mesh; – железо, ЦОДы и bare-metal-инфраструктуру. В течение дня вас ждут доклады, общение с коллегами и активности от партнеров. Будет возможность обсудить кейсы, обменяться опытом и познакомиться с коллегами из индустрии. После конференции вас ждет афтепати, где можно будет пообщаться с единомышленниками в более неформальной обстановке. 📍 Москва, 5-й Донской проезд, 17, Connect 📅 22 октября, 11:00–19:00 Хотите выступить на Kuber Conf? До 15 сентября можно подать заявку на доклад и стать спикером конференции. Делитесь практическими кейсами, опытом и экспертизой, которые будут полезны Kubernetes-сообществу! 👉 Программу, билеты и подробности сможете найти на сайте Kuber Conf от АОТ!

The GPU Bill Was $40,000. Nobody Knew Why.

Finance had flagged the AWS bill. GPU spend for the past 30 days: $40,200. The budget was $18,000. Nobody on the call could explain where the extra $22,000 had gone.

https://medium.com/@mateenanjum/the-gpu-bill-was-40-000-nobody-knew-why-e6e953b25f4a

We're a 3-person tech team running production Kubernetes — So we built an AI SRE

We needed help. Not a dashboard. Not another alerting rule. An actual pair of hands that could look at an alert, check if it's real, figure out what's wrong, and either fix it or tell us where to look.

https://medium.com/@leo_62530/were-a-3-person-tech-team-running-production-kubernetes-so-we-built-an-ai-sre-61ee28810448

GitHub Runners: Scaling ARC with Argo CD ApplicationSets

But managing multiple self-hosted runners manually can be tedious, especially in a Kubernetes environment. In this article, I'll show how I automated this process using Argo CD ApplicationSet, making my GitHub runners dynamic, declarative, and scalable.

https://medium.com/@nahuel.aldrey/github-runners-scaling-arc-with-argo-cd-applicationsets-5d660bee0ef4

Kubernetes AuthN the Hard Way

We're wiring together three components: OpenLDAP (your user directory), Dex (the authentication translator), and the Kubernetes API Server (the skeptical consumer of identity tokens). Every bug, every misconfiguration, and every "why is this not working" moment is documented here because I hit all of them personally.

https://medium.com/@jinalpatel11121999/kubernetes-authn-the-hard-way-cb191ec69dae

nodes/proxy GET: One Kubernetes permission too many

The nodes/proxy GET RBAC permission allows any ServiceAccount to execute code inside any Pod in the cluster, without leaving a single trace in the audit logs. This article details the issue, how to check if you are vulnerable, the fixes to apply, and the preventive measures you can put in place if you can't patch right away.

https://blog.zwindler.fr/en/2026/05/19/nodes/proxy-get-one-kubernetes-permission-too-many

VLAN Migration: Moving a Live Kubernetes Cluster Without Downtime

I migrated the entire k3s cluster from a flat network to a proper VLAN architecture: Server VLAN 20 for k3s nodes and services, Storage VLAN 30 for the NAS, and the existing default VLAN 1 for clients. This involved changing IPs on all VMs, updating MetalLB, reconfiguring Traefik, and recovering from an etcd quorum loss when I moved too many nodes at once.

https://blog.zolty.systems/posts/2026-02-16-vlan-migration

User Namespaces in Kubernetes Part I: All You Need to Know https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-i Part II: Mappings and File Ownership https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-ii Part III: The Implementation https://blog.sdfg.com.ar/posts/userns-in-kubernetes-part-iii