Blog
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 3517 posts
#2026-03 765#english 592#culture 264#deep-dive 254#kubernetes 247#career 229#ai 216#llm 208#devops 193#2026-04 146#security 141#database 114#observability 113#communication 109#history 107#architecture 100#productivity 96#finance 88#economy 84#mindset 81#psychology 80#ai-papers 79#food 78#it 78#travel 78#deep-learning 77#japanese 77#networking 77#performance 72#business-travel 70#linux 70#gpu 69#ai-agent 66#cs-fundamentals 63#postgresql 60#rag 58#self-improvement 55#learning 53#mlops 53#ai-platform 51
Integrating Ingress with ExternalDNS and Cloud Load Balancers — From Domain to L4
This post walks the full path traffic travels, from domain registration through the cloud load balancer to the Ingress controller. It covers AWS/GCP/Azure LB integration annotations, ExternalDNS automation, MetalLB, Prox
2026-06-14 · 18 min read #ingress#kubernetes#externaldns#loadbalancer#dnsIngress Multitenancy and Cost Optimization — A Platform Teams Choice
The trade-offs of a shared controller vs per-tenant controllers, namespace isolation, load balancer cost, resource quotas, noisy-neighbor prevention, security boundaries, and showback models — multi-tenant Ingress operat
2026-06-14 · 9 min read #ingress#kubernetes#networking#multitenancy#devopsIngress-level Authentication — Applying SSO with oauth2-proxy and Forward Auth
A practical guide to implementing SSO at the Ingress level using the external auth pattern. We walk through wiring oauth2-proxy as a forward auth service to layer OIDC login onto multiple apps without touching applicatio
2026-06-14 · 18 min read #ingress#oauth2-proxy#sso#authentication#kubernetesThe Complete Contour Guide - Managing Kubernetes Traffic with Envoy-Based Ingress and HTTPProxy
Contour is a Kubernetes ingress controller that uses Envoy as its data plane. We cover the HTTPProxy CRD, multi-tenancy through delegation, and Gateway API support with hands-on examples, plus operational tuning and trou
2026-06-14 · 16 min read #contour#envoy#ingress#kubernetes#httpproxyTimestamps and Time Zones, Done Right
Store UTC, display local. The epoch vs ISO 8601, the crucial difference between an offset and a time zone (the IANA tz database), the gaps and overlaps DST creates, leap seconds, why you must never trust the client clock
2026-06-14 · 12 min read #datetime#timezone#fundamentalsKernel Tuning for Low-Latency Trading Systems — The War Against Microseconds
How to tune the Linux kernel in domains like HFT and market making where microseconds decide profit and loss. Covers CPU isolation recipes, NUMA alignment, the kernel-bypass spectrum, C-state pinning, PTP time synchroniz
2026-06-13 · 17 min read #linux#kernel#low-latency#trading#performanceContainers Are a Lie — The Kernel Truth Behind cgroups and Namespaces
There is no container object in the kernel. A tour of the seven namespaces, hands-on cgroup v2 file manipulation, building a mini container with unshare and pivotroot, overlayfs, capabilities, and seccomp — we dissect ea
2026-06-13 · 17 min read #linux#kernel#container#cgroups#namespaceseBPF Fundamentals — Programs, Maps, and the World of the Verifier
A ground-up tour of how eBPF changed Linux kernel programming. We cover program types and maps, how the verifier works, and build a first eBPF program with libbpf and CO-RE from scratch.
2026-06-13 · 19 min read #ebpf#linux#kernel#libbpf#observabilityKubespray Deep Dive — Building Production On-Prem Kubernetes with Ansible
A complete walkthrough of building production-grade Kubernetes clusters on bare metal with Kubespray. Covers inventory design, dissecting key groupvars, HA control planes, air-gapped environments, day-2 playbooks for upg
2026-06-13 · 30 min read #kubernetes#kubespray#ansible#onprem#baremetalThe Evolution of the Linux CPU Scheduler — From CFS to EEVDF
We follow the evolution of the Linux scheduler, from CFS implementing fairness with vruntime and a red-black tree, to EEVDF which became the default in kernel 6.6 to address latency-sensitive workloads. Covers cgroup CPU
2026-06-13 · 17 min read #linux#kernel#scheduler#cfs#eevdfeBPF Observability in Practice — Opening the Black Box with bpftrace
Ten battle-tested bpftrace one-liners and a tour of the BCC toolbox for inspecting live systems without touching application code. Covers latency histogram interpretation, flame graphs, container environments, and three
2026-06-13 · 15 min read #ebpf#bpftrace#observability#linux#profilingA Packet Journey — Tracing the Linux Kernel Networking Stack
We dissect the full path a packet takes from the NIC through DMA, ring buffers, NAPI, and the IP/TCP layers to the application socket. Covers RSS/RPS/RFS multi-core scaling, GRO/GSO/TSO offloads, XDP, socket buffer tunin
2026-06-13 · 19 min read #linux#kernel#networking#tcp#xdpeBPF Runtime Security — Tetragon, Falco, and BPF LSM
Why runtime security is essential in the era of supply chain attacks and container escapes, and how eBPF answers the call. Covers Falco rule writing, kernel-level blocking with Tetragon TracingPolicy, the principles of B
2026-06-13 · 15 min read #ebpf#security#falco#tetragon#kubernetesCluster API Deep Dive — Managing Clusters as Kubernetes Resources
In an era of cluster sprawl, Cluster API lets you declare Kubernetes clusters themselves as Kubernetes resources and have controllers reconcile them. This deep dive dissects the architecture and core CRD relationships, a
2026-06-13 · 24 min read #kubernetes#cluster-api#multi-cluster#gitops#infrastructureIstio Ambient vs Sidecar — Choosing Your Service Mesh Architecture in 2026
A quantitative look at the resource cost and operational pain of the sidecar model, followed by a deep dive into the Ambient architecture built from ztunnel and waypoint proxies. Covers data path comparison, feature pari
2026-06-13 · 18 min read #istio#ambient-mesh#sidecar#ztunnel#kubernetesFinancial-Grade Kubernetes Platforms — Making Regulation and Cloud Native Coexist
How to design and operate a Kubernetes platform under financial regulations such as network segregation and electronic finance supervision rules. Covers multi-tenancy isolation criteria, Kyverno policy gates, audit trail
2026-06-13 · 20 min read #kubernetes#finance#security#compliance#multi-tenancyIstio Security in Practice — mTLS, AuthorizationPolicy, and the Zero Trust Mesh
From the mesh security model built on SPIFFE identities and the istiod CA, through the PERMISSIVE-to-STRICT migration strategy for PeerAuthentication, least-privilege AuthorizationPolicy design, JWT end-user authenticati
2026-06-13 · 21 min read #istio#mtls#security#authorizationpolicy#zero-trustOpen Banking and MyData API Architecture — The Technology of Financial Data Openness
The API architecture of Korean open banking shared network and MyData (personal credit information management). We cover standard API specs and auth tokens, comparison with UK Open Banking and the FAPI security profile,
2026-06-13 · 16 min read #finance#open-banking#mydata#api#oauth2ISO 20022 and SWIFT — The Great Migration of Financial Messaging Standards
From telex to SWIFT MT to ISO 20022 MX — the history and structure of financial messaging. We cover the pacs/pain/camt message families, field mapping between MT103 and pacs.008, the CBPR+ migration, message transformati
2026-06-13 · 15 min read #iso20022#swift#payments#financial-messaging#xmlIstio Traffic Management in Practice — From VirtualService to Automated Canaries
A hands-on guide covering the relationships between Istio traffic APIs, header and weight-based routing, canary automation with Flagger and Argo Rollouts, mirroring, fault injection, and how to derive circuit breaker set
2026-06-13 · 17 min read #istio#virtualservice#canary#traffic-management#kubernetes