Blog
Notes on DevOps, Kubernetes, self-hosted infrastructure and consulting.
19 posts tagged operasyon ·
clear filter
October 17, 2026
The Quiet Cause of Sporadic 502s: Idle Connection Timeouts and Keepalive Ordering
Load balancers, proxies and application servers close idle connections on different clocks. Get the order wrong and random 502s appear after quiet periods. The...
Read more →
October 14, 2026
Ransomware Resistant Backups: Object Lock, Versioning and Separating Writer from Deleter
A backup that production can delete is a backup an intruder can delete. The two object lock modes, append only identities, where the key lives, and how this com...
Read more →
October 13, 2026
Using Redis as a Data Store: Memory Policy, Persistence and Its Limits as a Queue
Redis arrives as a cache and ends up holding sessions and the job queue. Choosing maxmemory-policy, the cost of RDB versus AOF, what async replication loses, an...
Read more →
October 12, 2026
Finding Out What Actually Filled Up: inodes, Deleted but Open Files and Reserved Blocks
"Disk full" maps to at least three different conditions: blocks, inodes and space reserved for root. Same symptom, different remedy. How to measure before you d...
Read more →
October 11, 2026
PostgreSQL Autovacuum and Table Bloat: Dead Tuples, Transactions That Block Cleanup, and Per-Table Tuning
Default autovacuum thresholds let cleanup fall behind on large tables. How to measure bloat, find the old transactions that freeze cleanup, tune per table, get...
Read more →
October 10, 2026
Hardening Services with systemd: ProtectSystem, DynamicUser, System Call Filters and the Options That Break Things
Shrinking a service's attack surface from the unit file without reaching for containers: a starting template, measuring with systemd-analyze security, and the p...
Read more →
October 9, 2026
Cardinality Explosions in Prometheus: Choosing Labels, What a Series Costs and Stopping It at the Source
Every unique label combination is its own series, and one unbounded label can run Prometheus out of memory. Measuring series counts, the closed-set rule for lab...
Read more →
October 8, 2026
The Real Client IP Behind a Reverse Proxy: X-Forwarded-For, Trusted Proxies and Spoofed Headers
Behind a proxy, an application only learns the client address from a header. Reading X-Forwarded-For from the right, defining trusted proxies by address, nginx,...
Read more →
October 4, 2026
PodDisruptionBudgets and Node Drains in Kubernetes: Writing the Budget and Why Maintenance Gets Stuck
A PodDisruptionBudget only limits voluntary disruptions, and a badly written one either protects nothing or blocks node drains forever. Choosing between minAvai...
Read more →
October 3, 2026
Zero-Downtime Secret Rotation: Dual Keys, Alternating Users and the Consumers Left Behind
Rotation outages are caused by consumers, not by the value. Overlap windows, dual keys and alternating users, measuring the cutover, and the long-running proces...
Read more →
September 29, 2026
DNS Resolution in Kubernetes: ndots, Search Domains, CoreDNS Caching and the Five-Second Stalls
Why a pod turns one external lookup into eight DNS queries, what lowering ndots breaks, when autopath and NodeLocal DNSCache are worth it, where the exact five-...
Read more →
September 26, 2026
Kubernetes Resource Requests and Limits: CPU Throttling, OOMKilled and QoS Classes
A request is the scheduler's reservation, a limit is the kernel's quota. Why CPU gets paused while memory gets killed, how QoS classes decide eviction order, an...
Read more →
September 25, 2026
Zero-Downtime Schema Migrations: Expand and Contract, Locks and PostgreSQL Pitfalls
Rolling deploys are not enough; a schema change breaks the moment old and new versions run side by side. How to migrate PostgreSQL without downtime using expand...
Read more →
September 24, 2026
Stateful Resources Under Helm: Renames, resource-policy and CRD Pitfalls
Helm deletes a renamed PVC, restarts a StatefulSet on empty disks, regenerates passwords on every upgrade and never updates a CRD. Why data gets lost when state...
Read more →
September 22, 2026
Zero-Downtime Deployments in Kubernetes: Probes, preStop and Getting Graceful Shutdown in the Right Order
A rolling update alone does not give you zero downtime. Unless readiness and startup probes, a preStop delay, terminationGracePeriodSeconds, maxUnavailable and...
Read more →
September 21, 2026
Silent Failures in Bash Scripts: set -e, pipefail and Where Strict Mode Abandons You
set -euo pipefail does not make your script safe, it only gets you started. -e switching off inside function bodies, pipefail failing on SIGPIPE, -u ignoring em...
Read more →
September 20, 2026
Why Scheduled Jobs Break Quietly: Missed Runs, Overlap and Single Instance in cron, systemd Timers and Kubernetes CronJobs
Scheduled jobs break quietly in three ways: the missed run, the overlapping run and the failure nobody sees. How cron, systemd timers and Kubernetes CronJobs an...
Read more →
September 18, 2026
Backups are not enough: run restore drills
A green backup job gives false confidence, and an untested backup is not a backup. We cover the silent traps we hit, valid but incomplete archives, stale locks,...
Read more →
September 16, 2026
The PID 1 Problem in Containers: Zombie Processes and When You Need an Init System
The first process in a container is not an ordinary process as far as the kernel is concerned. Here is how that difference leads to zombie process buildup, how...
Read more →