The first is the KubeBuddy Headlamp plugin, which brings the full KubeBuddy check catalog (excluding the Cloud provider best practices) into Headlamp without touching your cluster configuration. The second is the Headlamp Theme Builder, a Headlamp plugin and browser-based design tool that turns your brand colours into a ready-to-install Headlamp theme plugin in minutes.

I tried a bunch on a separate EKS cluster, like HAProxy and Traefik, but eventually I landed on using Envoy Gateway since to me it felt like the most approachable and stable solution for our use case. Since I started the migration I made a respectable number of mistakes. These are my notes.

In this post, we'll walk through how we redesigned our Kubernetes-based PostgreSQL clusters for failover safety, how we balanced durability against latency, and what we learned while validating this approach through benchmarking and failure testing.

This is the problem helmsniff solves. It is a small, fast command line tool. It reads rendered Kubernetes manifests and writes a simple report. One row per Kubernetes object. One column per security check.

A few weeks ago I finally sat down and built it. This article is about what I built, what broke, and why I think Sveltos is one of the most underrated tools in the Kubernetes ecosystem right now.

В этом году главный сюжет — как меняется роль в эпоху AI. Смотрят на то, что уже автоматизируется, а что, наоборот, дорожает: пускают ли AI действовать в проде и где проходит граница доверия, добавляет ли сгенерированный код новых инцидентов, и что остается исключительно работой человека, когда рутину забирает машина. Отдельный блок про soft skills: какие навыки SRE-специалисты считают важными, в каких проседают и что не заменит AI.

Не обошли и человеческую цену надежности: сколько стоят дежурства по времени, деньгам и здоровью и на ком в команде реально концентрируется нагрузка.

Recently, I decided to migrate our Amazon EKS clusters (running version 1.35 on Bottlerocket OS) from the default AWS VPC CNI and kube-proxy over to Cilium. Migrating CNIs on a live cluster can be daunting, but by using a blue/green node pool strategy, the transition was seamless with zero disruption to our internal or external services.

This is a free, open checklist to help you deploy your applications to Kubernetes. No form, email, or download is required.

AegisBPF is an eBPF-based runtime security agent that monitors and blocks unauthorized file and network activity using Linux Security Modules (LSM).

A terminal based dashboard for Docker that monitors multiple hosts in real-time.

Polykube is a Kubernetes-native, GitOps-driven pattern for portable backend workloads. Desired state is delivered as Kubernetes resources, and reconciliation happens locally inside each member cluster.

In-cluster governance for AI agents on Kubernetes. Runtime-agnostic workload contracts, isolation and egress configuration, model-cost evidence, and offline-verifiable audit primitives.

Attune is a Kubernetes operator that automatically right-sizes pod resource requests and limits using In-Place Pod Resize.

Jarvis is an open source web frontend for Prometheus Alertmanager — interactive, realtime, and self-hosted.

A self-hosted workspace that puts a live metric chart next to the paragraph explaining it, gives your internal APIs Stripe-style docs, and lets a change go through a draft, a diff and an approval.