9 posts tagged with "devops"

A security scanner gave our main site 49/100, "Critical CSP gaps". There was no Content-Security-Policy at all, the favicon alone weighed 601 KB, and nobody had looked at how the frontends were cached or compressed.

The stack: three React + Vite single-page apps, each served by nginx in a container, behind a host nginx and Cloudflare, talking to FastAPI backends. Two environments, dev and prod, on two VPSs.

When I started, the platform had no monitoring at all. No host metrics, no central logs, no alerting, no traces. If a page was slow, the only tool was docker logs and a guess.

The stack: a handful of FastAPI services on MongoDB Atlas, a Django service on PostgreSQL, React frontends and MinIO for uploads, all in Docker Compose on two VPSs: production and dev. No Kubernetes, no budget for a SaaS observability bill, and a small team.

An internal developer platform succeeds or fails on six decisions. Not on the technology — Kubernetes, ArgoCD and Terraform are the baseline, and every platform uses them. The decisions are architectural, and they are invisible until the platform is in production and developers are either adopting it or working around it.

A cloud migration is rarely an infrastructure problem. It is a sequencing problem with a network topology attached. Move the wrong thing first and you spend the rest of the project working around a decision you cannot undo without starting over.

A pipeline migration is not a YAML translation exercise. It is a re-examination of every step in the pipeline and a decision about whether that step still belongs there. Most Jenkins pipelines carry years of accumulated logic that nobody remembers adding, and the migration is the first opportunity in years to delete it.

Kubernetes disaster recovery is not complicated. It is a checklist, and most teams get three-quarters of the way down it and stop. The missing quarter is the one that matters in an actual disaster.

This is the full checklist, from etcd snapshots to the restore runbook you need to test before you need to run it.

Observability is the difference between knowing something is broken and finding out from a user. On Kubernetes, the toolchain that answers this for most teams is Prometheus, Grafana and Alertmanager — three projects from the CNCF ecosystem that together give you metrics collection, dashboards and alerting.

This guide walks through setting them up, deciding what to monitor and configuring the alerts that actually matter.