Engineering notebook

Blog

Notes from practice — on platform engineering, GitOps, observability and infrastructure automation.

Security4 min read

Secretless CI/CD: OIDC Federation Instead of Long-Lived Keys

A service principal secret in your pipeline is just a well-stored data breach waiting for its moment — OIDC federation removes it entirely.

Read article→
GitOps4 min read

ArgoCD vs Flux: choosing a GitOps engine (from someone who runs both)

I've run ArgoCD on-prem and Flux on Azure for years — here are the real trade-offs, not a marketing feature matrix.

Read→
Observability5 min read

Prometheus at scale with Thanos: federated metrics across many clusters

Where a single Prometheus hits the wall, and why Thanos is the path to a global view, long-term storage and HA deduplication — with the real production gotchas.

Read→
Networking4 min read

Cilium and eBPF on bare-metal Kubernetes: networking without a cloud load balancer

How to give an on-prem cluster a working type: LoadBalancer using Cilium LB IPAM, L2 Announcements and KubeVIP — no MetalLB, no cloud.

Read→
Platform Engineering5 min read

Platform engineering and golden paths: reducing cognitive load, not adding a layer

An internal platform exists to take load off developers, not to add another team to route through — and most platforms fail precisely because they forget that.

Read→