DevOps&SRE Library

IPMan - IPSec Connection Manager for Kubernetes

IPMan is a Kubernetes operator that simplifies the management of IPSec connections, enabling secure communication between your Kubernetes workloads and the outside world.

https://github.com/dialohq/ipman

Autoscalable GitLab runners on AWS EC2

This article shares our experience of getting rid of continuously running EC2 instances, setting up scalable GitLab Runners in AWS, and significantly cutting CI infrastructure costs.

https://palark.com/blog/autoscalable-gitlab-runners-on-aws-ec2

From Ingress to Gateway API: How We Modernized Networking on Our GKE Cluster

We recently migrated our production GKE cluster from the traditional Ingress controller to the Kubernetes Gateway API — and honestly, we should have done it sooner.

https://the-devops-engineer.medium.com/from-ingress-to-gateway-api-how-we-modernized-networking-on-our-gke-cluster-8409ffb53173

Building a Real k6 Test Suite Against a Live Kubernetes App

In part 1 I covered k6's philosophy and the anatomy of a first test. This post is where things get real — a production-grade test suite running against a live microservices app on a homelab Kubernetes cluster, including what went wrong on the first run and how I debugged it.

https://dev.to/matthew_wimpelberg_79193b/part-2-of-4-building-a-real-k6-test-suite-against-a-live-kubernetes-app-1f81

My Experiments with MCP: Moving Beyond the "Agent Wrapper"

I'm currently working with a client to build out an agent-based automation system designed to reduce the manual labor associated with weekly, monthly, and ad-hoc operational activities.

https://godfreym.medium.com/my-experiments-with-mcp-moving-beyond-the-agent-wrapper-4142bb920f4a

Your AI just deleted the wrong deployment. Now what?

Picture this. A developer asks an AI assistant to "scale down staging to save costs." The AI, helpful as always, executes: kubectl scale deployment critical-api --replicas=0 -n production. Wrong namespace. Right outcome, wrong cluster. The API is down.

https://medium.com/@mirusser/your-ai-just-deleted-the-wrong-deployment-now-what-d9e3a03bf46c

Kafka on Kubernetes: Performance Lessons for Any Disk-Heavy Data Service

We recently started migrating Kafka clusters from EC2 to EKS using Strimzi. As soon as we moved the first cluster, we saw persistent disk reads across the brokers and higher latency than we expected on comparable hardware.

https://dev.to/yaakovamar/kafka-on-kubernetes-performance-lessons-for-any-disk-heavy-data-service-3bl5

What the Popularity of Emerging Tools Tells Us About Kubernetes' Future

Kubernetes has matured into a stable platform, while innovation is increasingly happening in the tools around it.

https://kube.today/emerging-tools-shaping-kubernetes-future

How Uber Conquered Database Overload: The Journey from Static Rate-Limiting to Intelligent Load Management

At this scale, even minor overloads aren't isolated events, they cascade. A brief spike in one part of the system can ripple outward: downstream services time out, retries pile up, and degradation amplifies into broader failure. This blog shares how we built an intelligent load manager that detects overload from multiple signals to keep our databases stable and fair under pressure.

https://www.uber.com/us/en/blog/from-static-rate-limiting-to-intelligent-load-management

Storage at scale: what I actually watched

For eight years I ran the SRE team behind a storage system measured in exabytes. Over time, the dashboard I checked every morning shrank to a handful of numbers. These are the seven that told me whether the service was healthy.

https://sridharrajarao.com/blog/storage-at-scale

archify

Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams—self-contained HTML with motion and crisp export.

https://github.com/tt-a1i/archify

Personal-AI-Router

NVIDIA Personal AI Router (PAIR) is a local inference router for a group of compatible computers on the same network. It discovers participating nodes, manages supported inference engines, and presents Ollama-compatible and OpenAI-compatible proxy endpoints to applications and agents. Independent requests can be routed to eligible nodes according to engine availability, model availability, and current workload.

https://github.com/NVIDIA/Personal-AI-Router

web-llm

WebLLM is a high-performance in-browser LLM inference engine that brings language model inference directly onto web browsers with hardware acceleration. Everything runs inside the browser with no server support and is accelerated with WebGPU.

https://github.com/mlc-ai/web-llm

Автоматизация платформы не отбирает у вас интересные задачи. Она забирает рутину. Deckhouse Platform берёт на себя обновление, масштабирование и поддержку инфраструктуры «из коробки». Освободившееся время остаётся вам — на то, что вам действительно нравится. Обсудите с инженерами Deckhouse, что можно автоматизировать в вашем стеке 👈

solo

Ship one musl-linked executable. At runtime, load the user's existing glibc-linked GPU driver. No container, no AppImage, and no second libc in the process.

https://github.com/pg83/solo

Inside Cilium CNI: solving mysterious Kubernetes pod setup timeouts

In high-performance networking, 35 seconds is a lifetime. This was the latency required to iterate through our connection tracking table of 7 million entries at a maximum speed of 200,000 entries per second. At our 16-million-entry peak, this sequential lookup could take up to 80 seconds, leading to Cilium CNI timeouts preventing new pods from starting on affected nodes.

https://www.adyen.com/knowledge-hub/inside-cilium-cni-solving-kubernetes-pod-setup-timeouts

tailcat

Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.

https://github.com/tailscale/tailcat

When declaring an incident becomes everyone's favorite workaround

You see someone declare a Sev-2 and you wonder: wait, why is that even an incident? Nothing is down. Customers aren't affected. But a manager needed to get their team's problem to the top of another team's priority queue, and the incident process was a reliable way to make it happen.

https://greatcircle.com/blog/2026/08/11/declaring-incidents-for-side-effects

eBPF: рентгеновское зрение для production Сервис замедлился, соединения обрываются, а привычные показатели указывают только на симптом. Чтобы найти настоящую причину, иногда нужно увидеть, что происходит глубже — на уровне ядра Linux. 23 сентября в 20:00 на открытом уроке курса «DevOps практики и инструменты» познакомитесь с eBPF — технологией, которая помогает исследовать сетевые события, производительность и безопасность работающей системы. На демонстрации вы увидите, как Cilium Hubble показывает сетевые взаимодействия и помогает находить проблемы с трафиком. С помощью Tetragon разберёте обнаружение подозрительной активности на уровне ядра. Также рассмотрите диагностику узких мест без остановки сервисов. Преподаватель объяснит архитектуру eBPF простыми словами — как программы безопасно запускаются в ядре, какие данные можно получать и почему этот подход расширяет возможности традиционного мониторинга. Вы поймёте, для каких задач eBPF действительно полезен, где он дополняет существующие средства наблюдаемости и когда его внедрение будет избыточным. 👉 Зарегистрируйтесь: https://vk.cc/d1Nx9k Реклама. ООО «Отус онлайн-образование», ОГРН 1177746618576, erid: 2VtzqxT3ABE

HAProxy Data Plane API

Data Plane API is a sidecar process that runs next to HAProxy and provides API endpoints for managing HAProxy. It requires HAProxy version 1.9.0 or higher.

https://github.com/haproxytech/dataplaneapi