📰 Dev.to · Guatu

In Traefik v3, a wildcard router can outrank an exact Host match, because default priority is rule string length. Here's how it fails and how to fix it.

A comparison of cloud APIs vs local models for scheduled agent memory curation, and the headless-cron gotchas nobody warns you about.

A disallow-latest-tag policy only blocks new admissions. That gap turns a routine pod eviction into a permanent outage. Here's the failure mode and the fix.

A Longhorn volume can report Healthy while the filesystem inside your pod has been read-only for hours. How to detect it, recover it, and alert on it.

Qdrant snapshots on emptyDir vanish on restart, and snapshots on the data PVC die with the disk. Here's the NFS-backed pattern that survives both.

How to write Prometheus alerts that carry context, tolerate transient scrape blips, and page only when something is actually broken.

How SealedSecrets lets you commit encrypted secrets to Git safely, why the real risk is losing the controller's private key, and how to back it up.

Your bare-metal LoadBalancer Service is stuck Pending. Here's how MetalLB hands out real LAN IPs, why L2 mode works, and the traps that cost me hours.

Running PostgreSQL on Kubernetes with CloudNativePG: the Kyverno policy traps, SSL gotchas, read/write splitting, and the 16.4 segfault to avoid.

Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.

Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.

Moving beyond cloud S3 to a bare-metal backup strategy using Velero, MinIO, and Longhorn. Lessons on CSI snapshots and ETCD persistence.

How to implement controlled escalation for AI agents using safeBins and network-level constraints to prevent production catastrophes.

Stop cramming every metric into one screen. A practical look at balancing information density and performance in Grafana dashboards.

Moving beyond cluster-admin for everything. A practical approach to scoping ServiceAccount permissions for production workloads and AI agents.

Moving beyond basic cert-manager setups to handle DNS-01 challenges, Kubernetes ndots resolution issues, and dynamic IP automation with Cloudflare.

Moving beyond basic tool-calling to a composable skill pattern that makes agent capabilities discoverable and reusable across different frameworks.

Stop trusting the Longhorn UI blindly. Learn to monitor replication, fix stale mounts, and manage snapshot bloat in production K8s storage.

Moving beyond the happy path of Kubernetes policy enforcement. Real-world Kyverno pitfalls, mutation loops, and the gap between docs and production.

Fixing the silent failure of sysctl settings when running Docker inside unprivileged Proxmox LXC containers.

Setting up AdGuard Home for network-wide DNS filtering with a robust failover strategy to prevent total internet outages.

Don't let invalid manifests break your GitOps pipeline. Learn how to use kubeconform and Kyverno exclusions to catch errors before they hit production.

Automating TLS with cert-manager and Cloudflare DNS-01 in Kubernetes

How to back up and recover SealedSecrets encryption keys in Kubernetes