weblogseries
Post series
Multi-part write-ups: 13 series, 82 posts. Posts in a series are listed in reading order.
01k0s Cluster Setup9 posts
- Traefik Middleware for security headers: HSTS, CSP, and frame protection
- cert-manager: wildcard certificates with DNS-01 challenge
- Setting up a Debian VPS for k0s: sysctl, kernel modules, and the install
- Helm charts declared in k0s config: Flannel, Traefik, cert-manager, Prometheus
- Automatic TLS with cert-manager, Let's Encrypt, and Traefik IngressRoutes
- Self-hosted Docker registry inside the k0s cluster
- Deploying to k0s with a shell script instead of CI/CD
- Full observability on one VPS: metrics, logs, alerts, dashboards — 452 MiB requested
- Traefik → APISIX on a single node: what broke during the ingress migration
02Cilium Deep-Dive6 posts
- Cilium as kube-proxy replacement with L2 LoadBalancer on k3s
- Hubble: network observability built into Cilium
- Cilium network policy: default-deny and workload isolation
- Cilium NetworkPolicy: default-deny and DNS-aware rules
- Cilium L2 LoadBalancer on bare-metal k3s
- Bare-metal k8s: keep Cilium L2 LoadBalancer & node maintenance reliable
03FluxCD & GitOps10 posts
- FluxCD hub-and-spoke: managing multiple Kubernetes clusters from one git repo
- Kustomize base/custom/patch: DRY Helm values across environments
- FluxCD hub-and-spoke: one cluster to manage them all
- Flux Notification Controller: commit status, Telegram, Mattermost
- GitLab CI for an infra repo: lint, validate, and flux reconcile
- Flux Image Update Automation: auto-bump image tags in git
- Kustomize configMapGenerator and secretGenerator
- Adding a new environment to a FluxCD hub-and-spoke cluster
- Debugging Flux reconciliation: a field guide
- Wildcard TLS with ACME and cert-manager: Automating Let's Encrypt via Yandex Cloud DNS
04Logs & Observability8 posts
- Elastic APM Server in Kubernetes
- VictoriaLogs + Vector: replacing EFK with a lightweight log stack
- Elasticsearch in Kubernetes: HelmRelease, ingest pipelines, and bootstrap
- Vector: log pipeline from Kubernetes to Elasticsearch
- Loki and LogQL: logs without Elasticsearch overhead
- Elasticsearch Index Lifecycle Management
- VictoriaLogs on k0s: a log database that fits in 128 MiB
- Promtail: shipping Traefik access logs to VictoriaLogs
05Prometheus Monitoring Stack12 posts
- Writing good PrometheusRules: structure, labels, and unit tests
- Kafka alerting in Kubernetes: from broker down to consumer lag
- node-exporter alerting: clocks, disks, and inotify limits
- Prometheus exporters in Kubernetes: kafka, mongodb, redis, and more
- kube-prometheus-stack on multi-cluster: spoke Prometheus, central Grafana
- VictoriaMetrics Operator: VMAgent, VMSingle, VMServiceScrape
- Prometheus recording rules: pre-aggregating expensive queries
- Grafana datasource and dashboard provisioning via ConfigMap
- kube-prometheus-stack: the full monitoring setup
- Blackbox exporter and Prometheus Probes for endpoint monitoring
- Multi-cluster Prometheus: remote_write to central VictoriaMetrics
- vmsingle: one VictoriaMetrics binary instead of the whole Prometheus stack
06This Site: FastAPI3 posts
07Proxy & VPN6 posts
- Proxy mesh in Kubernetes: Tor exit nodes and geo-routing with hola-proxy
- Three proxies on one server: HTTP, SOCKS5, and Shadowsocks
- IKEv2 and WireGuard running in separate Kubernetes namespaces
- VPN status monitoring: WireGuard + IKEv2 in real time
- Rotating Tor HTTP proxy in Kubernetes
- Shadowsocks proxy in Kubernetes
08.NET on Kubernetes5 posts
- Multi-stage Dockerfile for .NET: build once, run lean
- OpenTelemetry in .NET: traces, metrics, and logs with minimal boilerplate
- ELK in Kubernetes: Elasticsearch, APM Server, and Kibana
- SonarQube in GitLab CI: dotnet-sonarscanner and coverage delta
- NuGet library CI: versioning from branch name and dual-registry publish
09GitLab CI Pipelines7 posts
- SonarQube in Kubernetes: deployment and GitLab CI integration
- GitLab Runner in Kubernetes
- GitLab CI Docker deploy pipeline: build, push, and rolling update
- GitLab CI DinD: Docker builds with BuildKit caching
- Helm chart testing: lint, unit tests, and ct in CI
- Trivy + SonarQube: security scanning in a GitLab CI pipeline
- GitLab CI multi-environment pipeline: workflow rules and deploy gates
10Secrets Management7 posts
- HashiCorp Vault: bootstrap, unseal, and Kubernetes auth
- Sealed Secrets: the full ceremony from install to cluster migration
- External Secrets Operator with HashiCorp Vault: JWT auth and KV v2
- SealedSecrets: storing encrypted kubeconfigs in git
- External Secrets Operator + HashiCorp Vault: Kubernetes auth flow
- Vault JWT auth from GitLab CI: no static tokens
- consul-template in the GitLab CI deploy job