Kyverno allowLatestTag Pitfalls: How Policy Can Stop Pods From Restarting
A disallow-latest-tag policy only blocks new admissions. That gap turns a routine pod eviction into a permanent outage. Here's the failure mode and the fix.
#gitops
8 posts
SealedSecrets: Storing Secrets in Git Without the Risk
How SealedSecrets lets you commit encrypted secrets to Git safely, why the real risk is losing the controller's private key, and how to back it up.
Kyverno Admission Controllers: Policy-as-Code That Actually Works
Moving beyond the happy path of Kubernetes policy enforcement. Real-world Kyverno pitfalls, mutation loops, and the gap between docs and production.
Stop Merging Broken YAML: Kubernetes Manifest Validation in CI
Don't let invalid manifests break your GitOps pipeline. Learn how to use kubeconform and Kyverno exclusions to catch errors before they hit production.
SealedSecrets Key Backup: Don't Lose Your Encryption Keys
How to back up and recover SealedSecrets encryption keys in Kubernetes
Infrastructure as Code, but Automated: OpenTofu and GitHub Actions
Stop manual applies. Learn how to build a production-ready CI/CD pipeline for your infrastructure using OpenTofu and GitHub Actions.
GitOps for Homelabs: How ArgoCD App-of-Apps Scales Your Cluster
How the ArgoCD app-of-apps pattern brings real GitOps discipline to homelab Kubernetes — repo structure, examples, and what I'd do differently.
Building a Production Homelab: Multi-Node Proxmox Cluster with Kubernetes
How I built a multi-node Proxmox cluster running Kubernetes with GPU passthrough, GitOps, and dozens of services — and what broke along the way.