Stateful workloads in Kubernetes, and the question you should ask first
A StatefulSet guarantees less than people assume, a volume pins a pod to a zone, and the honest question is whether that database belongs in the cluster at all.
Blog
Kubernetes
Articles about Kubernetes from the ConsultorIA blog: cloud, applied AI and security in production.
A service mesh solves three problems and costs you an operator
Mutual TLS, fine-grained traffic control and uniform telemetry without touching application code. What each one actually costs in latency, memory and operational load, and the cheaper things that cover two out of three.
Prometheus stops working the way you first built it
Cardinality is behind almost every Prometheus problem you will have, and it is usually one label added by one well-meaning engineer. How to find it, how to survive retention and HA, and when Thanos or Mimir is actually justified.
Splitting a shared cluster's bill so teams believe the number
Allocation by requests or by usage creates opposite incentives, shared costs start the argument, and showback before chargeback is what stops the whole exercise being rejected.
Policy in the cluster, without the webhook that takes it down
Kyverno or Gatekeeper is a smaller decision than how you roll policy out. Audit, then warn, then enforce, with system namespaces excluded and a failure policy you have thought about.
Cluster posture scanning, and the six findings that are always there
Every Kubernetes benchmark scan produces hundreds of findings and the same handful matter. Here is which ones, why the control plane checks mostly do not apply on managed clusters, and how to stop the report being ignored.
Several teams, one cluster, without anyone standing on anyone
A namespace is a naming boundary, not a security boundary. Quotas, default-deny network policy, workload identity and a clear answer on node isolation are what make a shared cluster work.
Cluster upgrades stop being an event when you do them monthly
The support calendar decides your schedule whether you plan or not. Deprecated APIs, blocked drains and add-ons that lag the control plane are the three things that turn an upgrade into an incident.
GKE cost, and why Autopilot moves the waste rather than removing it
Standard bills for nodes you provision, Autopilot bills for pod resources you request. Both are dominated by the same number, and it is the gap between what pods ask for and what they use.
Ingress ran out of road. Gateway API is the replacement, and the argument is the org chart
Gateway API is usually sold on features. The real reason to move is that Ingress has no separation between the team that owns the load balancer and the team that owns the route. Here is the migration that does not need a maintenance window.
Falco tells you what a container did, not what it might do
Image scanning finds known vulnerabilities before deployment. Runtime detection catches the shell that spawned inside a running pod at three in the morning. The default rules are noisy and tuning them is the entire project.
A Kubernetes Secret is base64, and everyone learns this too late
Getting secrets out of manifests means an operator that syncs from your cloud's vault, a driver that mounts them, or both. The part that decides which is what your application does when the value changes.
Crossplane turns infrastructure into a control plane, and that is the whole argument
A pipeline runs when someone triggers it. A controller reconciles continuously, which fixes drift by construction. What you pay is another control plane to operate and a harder debugging story.
AKS spend: the node pool decisions that set your bill
The AKS control plane is nearly free, so everything you pay comes from node pools, and the defaults are expensive. Here is what we change, in the order that finds money fastest.
A Jenkins that does not rot: configuration as code, ephemeral agents, shared libraries
The three changes that turn a hand-configured Jenkins into one you can rebuild from an empty machine in twenty minutes, and what each one costs to adopt.
Self-hosted GitHub Actions runners: when the maths works and how not to get owned
Hosted minutes stop being cheap somewhere around 100,000 a month. Running your own runners on Kubernetes is straightforward; running them safely takes three specific decisions.
Argo CD in production: what GitOps actually changes about your deploys
Argo CD is easy to install and easy to misuse. The repository layout, the sync policy and the secrets decision that separate a working GitOps setup from a dashboard full of red.
Canary deploys that actually catch problems: Argo Rollouts and Flagger
Shifting 10 percent of traffic to a new version is not a canary if nothing is watching. The metrics, the analysis window and the abort rule that make progressive delivery worth the complexity.
Running CI inside Kubernetes: Tekton, Argo Workflows and when not to
Kubernetes-native CI gives you pipelines as custom resources and scaling for free. It also gives you a pipeline engine you now operate. When that trade is worth making.
Why your EKS cluster costs twice what it should
Kubernetes hides waste better than any other platform, because everything looks busy. Four measurements tell you where the money goes, and three changes usually halve it.
Self-hosting n8n in production: the four things that break
n8n on a single container is a demo. Running it for a company means queue mode, a real database, a plan for credentials and a restore you have tested. Here is the shape that survives.
GKE Autopilot or Standard: the decision, with the costs nobody quotes
Autopilot charges for what your pods request and removes node management. That is a better deal than it sounds for most teams and a worse one for a few. Here is how to tell which you are.
Cloud Run or GKE: the four questions that decide it
Most teams running GKE would be better served by Cloud Run, and a few running Cloud Run are fighting it. The decision is not about scale — it is about four specific requirements.
Trivy and Grype: making container scanning produce fixes instead of numbers
Every image scan returns hundreds of CVEs and almost none of them are reachable. How we cut the list down to what is exploitable, where each tool is stronger, and why the base image is the whole game.
Putting AKS into production: the decisions that are hard to change later
Network plugin, identity model, node pool layout and upgrade strategy are all chosen in the first hour and all painful to change afterwards. Here is what we pick and why.
OKE in production: what is different from EKS and GKE
Oracle's managed Kubernetes is closer to the others than people expect, with three genuine differences: the free control plane, the ARM allowance and a networking model you choose at creation.