https://okulbida.com/ Recent content on Oleksandr Kulbida Hugo -- gohugo.io Fri, 07 Aug 2026 00:00:00 +0300 https://okulbida.com/posts/terraform-to-opentofu-migration/ Fri, 07 Aug 2026 00:00:00 +0300 https://okulbida.com/posts/terraform-to-opentofu-migration/ A reader sent me a question I’ve been getting more often lately: they’re running Terraform 1.5, S3 backend, no Terraform Cloud, no HCP. Is it worth moving to OpenTofu? Short answer: probably yes, and this setup happens to be close to the easiest case there is. Here’s why. The fork point matters OpenTofu forked from Terraform 1.5.x, the last version released under the MPL license before HashiCorp switched to BSL. So if you’re still on 1. https://okulbida.com/posts/kubernetes_tools/ Sat, 27 Jun 2026 00:00:00 +0300 https://okulbida.com/posts/kubernetes_tools/ This list is being updated on regular basis General info https://kubernetesreadme.com/ UI / Desktop Clients K9s — terminal UI for navigating clusters, resources, events, logs, and metrics https://k9scli.io/ Freelens — free and open-source IDE for Kubernetes (community fork of Lens, no account required) https://github.com/freelensapp/freelens Lens — full-featured Kubernetes desktop IDE with workload, metrics, and troubleshooting views https://k8slens.dev/ Headlamp — web-based Kubernetes UI, good for remote admin https://headlamp.dev/ Kubevious — maps cluster relationships and highlights configuration issues visually https://kubevious. https://okulbida.com/posts/aws-lambda-microvms-stateful-sandboxes/ Tue, 23 Jun 2026 00:00:00 +0200 https://okulbida.com/posts/aws-lambda-microvms-stateful-sandboxes/ AWS just shipped something that reframes what “serverless” can mean. Lambda MicroVMs are not Lambda Functions with a bigger timeout. They are a fundamentally different primitive: stateful, VM-level isolated environments with an explicit lifecycle you control. The key shift: instead of getting a recycled process for 15 minutes, you get a dedicated Firecracker microVM that lives up to 8 hours. You decide when it starts, suspends, resumes, and terminates. What Lambda MicroVMs actually are Regular Lambda Functions are stateless by design. https://okulbida.com/posts/ai-agents-knowledge-base-obsidian-local-llm/ Fri, 15 May 2026 00:00:00 +0200 https://okulbida.com/posts/ai-agents-knowledge-base-obsidian-local-llm/ Building AI agents sounds fun until you actually build one. Then a different set of problems shows up — ones nobody writes about. Here is what I have learned running agent systems in production: self-improvement conflicts with git, most knowledge bases hit a wall sooner than expected, and adding more agents almost never helps. The self-improvement problem One of the selling points of agents like Hermes is that they can self-reflect and improve, updating their own rules based on experience. https://okulbida.com/posts/axios-npm-supply-chain-min-release-age/ Fri, 15 May 2026 00:00:00 +0200 https://okulbida.com/posts/axios-npm-supply-chain-min-release-age/ npm min-release-age Use npm ci, not npm install Lock down npm with .npmrc Hardening GitHub Actions Summary In late March 2026, compromised axios builds briefly appeared on the npm registry (for example 1.14.1 and 0.30.4 on affected release lines). Attackers added a malicious dependency and used lifecycle scripts so a plain npm install could pull down far more than an HTTP client. This is a pattern seen before in registry incidents, not a bug in axios’ normal code. https://okulbida.com/posts/terraform-gitops-state-management-alternatives/ Fri, 08 May 2026 00:00:00 +0200 https://okulbida.com/posts/terraform-gitops-state-management-alternatives/ If you’ve been using Terraform Cloud for a while, you’ve probably hit at least one of these: the pricing model changed and suddenly it’s expensive, applies take 10+ minutes, or the state files have grown into something nobody wants to touch. You’re not alone. This comes up a lot in Terraform discussions lately. This post covers the main tools people are using to solve these problems in 2025–2026, with a focus on two separate issues that often get conflated: GitOps orchestration (who triggers plans, who approves applies) and state management at scale (why applies are slow and what to do about it). https://okulbida.com/posts/eks-python-urllib3-ssl-certificate-verify-failed/ Wed, 29 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/eks-python-urllib3-ssl-certificate-verify-failed/ Bumped to Python 3.13 and suddenly your Kubernetes automation stopped working? Here’s the error you’re probably seeing: 1 2 3 4 5 urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='xxxx.gr7.us-east-1.eks.amazonaws.com', port=443): Max retries exceeded with url: /version/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028)'))) Nothing changed on the cluster side. The problem is on your machine — specifically the combination of Python 3.13 and urllib3 2.4.0. Tracked in kubernetes-client/python#2394. https://okulbida.com/posts/harden-runner-github-actions-egress-monitoring/ Fri, 24 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/harden-runner-github-actions-egress-monitoring/ Most teams have no idea what their CI runners connect to during a build. Packages get installed, scripts run, network calls go out — and none of it is logged. That is a real blind spot. Harden-Runner from StepSecurity is a GitHub Action that monitors and optionally blocks outbound network connections at the runner level, in real time. Think of it as an EDR for your CI pipeline. It caught the axios supply chain attack in real time — any connection to sfrclak. https://okulbida.com/posts/prom-cheat-sheet/ Fri, 17 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/prom-cheat-sheet/ Key functions — rate, irate, increase, histogram_quantile, absent, absent_over_time, delta, predict_linear, age Aggregations — sum, count, topk, by/without, quantile_over_time, bool, offset Label manipulation — label_replace, label_join Useful queries — CPU %, pod restarts, error rate, SLO, memory, network by AZ, nodegroup, cardinality Relabeling tricks — drop metrics, series, labels Pre-commit validation — promtool, pint Architecture — agent mode, VictoriaMetrics, Thanos, Mimir Tools Key functions rate vs irate https://okulbida.com/posts/aws-s3-files-mount-bucket-as-filesystem/ Fri, 10 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/aws-s3-files-mount-bucket-as-filesystem/ AWS quietly launched S3 Files - a way to mount an S3 bucket and work with it like a regular file system. No custom SDK, no aws s3 cp, just standard file operations on top of S3. How it works You mount the bucket via a managed endpoint and get a POSIX-compatible interface on EC2, Lambda, EKS, and ECS. Your existing tools and applications don’t need to know it’s S3 underneath. https://okulbida.com/posts/claude-code-hardening-permissions-hooks-commands/ Fri, 10 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/claude-code-hardening-permissions-hooks-commands/ Claude Code is a powerful local agent. By default it can read most files on your machine. Here is how to lock it down and extend it for your workflow. Block access to credential files Put this in your global Claude settings at ~/.claude/settings.json. Claude will refuse to read any of these paths — even if you accidentally ask it to. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 { "permissions": { "deny": [ "Read(~/. https://okulbida.com/posts/guardduty-phishing-url-resolution-ssrf/ Fri, 03 Apr 2026 00:00:00 +0200 https://okulbida.com/posts/guardduty-phishing-url-resolution-ssrf/ Click to enlarge GuardDuty screams about a phishing domain. The node looks fine — no malware, no stolen creds. Often the real story is simpler: your app looked up a URL someone pasted in a message, and that hostname is on a threat list. The alert is still “true” (DNS to a bad name happened), but it’s not a hacked cluster. The uncomfortable part: if you resolve or fetch any user URL with no checks, you also open the door to SSRF — for example a link to 169. https://okulbida.com/posts/ingress2gateway-1-0-migrating-from-ingress-nginx/ Wed, 25 Mar 2026 10:00:00 +0300 https://okulbida.com/posts/ingress2gateway-1-0-migrating-from-ingress-nginx/ If you’re running Ingress-NGINX in production, you’ve probably seen the writing on the wall. The retirement was announced back in November 2025, and as of March 2026, it’s happening. The Ingress API isn’t going away overnight, but active development on Ingress-NGINX is done. Time to move. The good news: SIG Network just shipped Ingress2Gateway 1.0, a migration tool that actually works now. What Changed in 1.0 Previous versions were barely usable — they supported only three Ingress-NGINX annotations. https://okulbida.com/posts/how-container-filesystem-works/ Thu, 12 Mar 2026 22:00:00 +0300 https://okulbida.com/posts/how-container-filesystem-works/ One of the superpowers of containers is their isolated filesystem view. From inside a container it looks like a full Linux distro, often different from the host. Run docker run nginx, and Nginx lands in its familiar Debian userspace no matter what Linux flavor your host runs. But how is that illusion built? In this post, we’ll walk through how to assemble a tiny but realistic container using only stock Linux tools: unshare, mount, and pivot_root. https://okulbida.com/posts/future-of-software-engineering-thoughtworks-2026/ Thu, 12 Mar 2026 21:00:00 +0300 https://okulbida.com/posts/future-of-software-engineering-thoughtworks-2026/ Martin Fowler published a fascinating report from a February 2026 retreat where senior engineering practitioners from major tech companies gathered to discuss how AI is reshaping software development. It’s dense, so here’s what stood out to me. Where Does the Rigor Go? The biggest question of the retreat: if AI writes the code, where does the engineering discipline move? The answer is that it doesn’t disappear, it migrates: Upstream to specs: bad specs produce bad code at scale. https://okulbida.com/posts/ai-engineer-repos-2026/ Thu, 12 Mar 2026 20:00:00 +0300 https://okulbida.com/posts/ai-engineer-repos-2026/ If you’re building AI systems in production — or just getting started — these repos are worth bookmarking. LLM Serving & Inference vLLM (66k+ stars) — The industry standard for high-throughput LLM serving. Continuous batching and maximum GPU utilization. If you’re serving LLMs in production, this is probably what you should be using. Ollama (162k+ stars) — The easiest way to run LLMs locally. Great for fast experimentation before you commit to a cloud setup. https://okulbida.com/posts/aws-sqs-cost-surprises-short-polling/ Sun, 28 Dec 2025 20:00:00 +0300 https://okulbida.com/posts/aws-sqs-cost-surprises-short-polling/ SQS is cheap until it isn’t. Real example from the wild: $500k in a weekend, and Amazon reportedly asked the team not to delete everything at once in certain regions, as it could impact the service. The usual culprit isn’t message volume; it’s how often you call ReceiveMessage when the queue is empty. How SQS Billing Works You pay per request (SendMessage, ReceiveMessage, DeleteMessage, etc.), not per message. Standard queue: about $0. https://okulbida.com/posts/aws-billing-transfer-session-summary/ Sun, 28 Dec 2025 18:00:00 +0300 https://okulbida.com/posts/aws-billing-transfer-session-summary/ AWS Billing Transfer is a new feature (GA since November 2025) that lets you manage billing across multiple AWS Organizations from one account. It helps companies and channel partners who manage multiple Organizations by enabling centralized billing while keeping security and autonomy decentralized for business units or end customers. Key Challenges Addressed Multiple Organizations – Separate logins for billing and cost management across Organizations increase operational overhead No Central View – Hard to get a single, holistic view of spend across business units or customers Confidential Pricing – Protecting pricing data when billing and security roles are separated (e. https://okulbida.com/posts/volsync-kubernetes-volume-migration/ Sun, 28 Dec 2025 16:00:00 +0300 https://okulbida.com/posts/volsync-kubernetes-volume-migration/ VolSync is a Kubernetes operator that asynchronously replicates persistent volumes between clusters using rsync or rclone. It also supports creating backups of persistent volumes via restic. Installation: Install VolSync via Helm: 1 2 helm repo add backube https://backube.github.io/helm-charts/ helm install --create-namespace -n volsync-system volsync backube/volsync Migrating Data into Kubernetes: VolSync provides a CLI tool (kubectl-volsync) for migrating data from external storage into Kubernetes PersistentVolumes. Step 1: Install VolSync CLI https://okulbida.com/posts/terraform-code-organization-best-practices/ Sun, 28 Dec 2025 14:00:00 +0300 https://okulbida.com/posts/terraform-code-organization-best-practices/ Essential Terraform best practices for organizing and structuring your infrastructure code: 1. Separate Configuration Files Instead of putting all code in main.tf, distribute it across multiple files: main.tf: Calls modules, locals, and data sources to create all resources variables.tf: Contains variable declarations used in main.tf. Place required variables at the top and optional ones at the bottom, separated by a comment line for better readability outputs.tf: Contains outputs from resources created in main. https://okulbida.com/posts/aws-control-tower-landing-zone-4.0/ Sat, 27 Dec 2025 13:00:00 +0300 https://okulbida.com/posts/aws-control-tower-landing-zone-4.0/ AWS Control Tower Landing Zone 4.0 introduces a flexible Controls-Only experience, allowing full programmatic setup and customization of multi-account environments. Key Changes: Optional Service Integrations - Choose which integrations to enable: AWS Config AWS CloudTrail Security Roles AWS Backup Dedicated Resources - Better isolation with separate resources per service: Separate S3 buckets for AWS Config and CloudTrail Individual SNS topics for each service Flexible Organization Structure - Removed previous requirements: https://okulbida.com/posts/github-platform-engineering-approaches/ Sat, 27 Dec 2025 00:30:00 +0300 https://okulbida.com/posts/github-platform-engineering-approaches/ GitHub’s platform engineering team on how they tackle infrastructure problems at scale: Understanding your domain: Talk to neighboring teams with more experience Investigate old issues to understand system limitations Read documentation to build foundational knowledge Platform-specific skills: Network fundamentals (TCP, UDP, L4 load balancing, debugging tools) Operating systems and hardware selection for scalability and cost Infrastructure as Code (Terraform, Ansible, Consul) Distributed systems understanding (failures are inevitable, need failover/recovery) Impact radius considerations: https://okulbida.com/posts/acm-automated-certificate-management-kubernetes/ Sat, 27 Dec 2025 00:00:00 +0300 https://okulbida.com/posts/acm-automated-certificate-management-kubernetes/ AWS Certificate Manager (ACM) now supports automated certificate management for Kubernetes workloads through AWS Controllers for Kubernetes (ACK). Previously, using ACM certificates in Kubernetes required manual steps: exporting certificates via API, creating Kubernetes Secrets, and manually updating them at renewal. With ACK, you can define certificates as Kubernetes resources, and the controller automates the complete lifecycle - requesting, exporting, creating Secrets, and auto-updating at renewal. This works for both public certificates (ACM exportable certificates) and private certificates (AWS Private CA), enabling automated certificate management for: https://okulbida.com/posts/cloudflare-terraform-state-security/ Tue, 23 Dec 2025 16:00:00 +0300 https://okulbida.com/posts/cloudflare-terraform-state-security/ Managing Terraform state securely is one of those things that seems simple until you’re dealing with hundreds of accounts and thousands of resources. Cloudflare, being their own Customer Zero, had to solve this problem at enterprise scale. The interesting part? They built a custom solution called tfstate-butler - a Go program that acts as an HTTP backend for Terraform state storage. The Security Problem When you’re managing infrastructure at Cloudflare’s scale, a single compromised state file could be catastrophic. https://okulbida.com/posts/aws-2025-things-you-think-you-know/ Tue, 23 Dec 2025 14:00:00 +0300 https://okulbida.com/posts/aws-2025-things-you-think-you-know/ You know what’s wild? AWS is almost twenty years old now. That’s both cool and kind of terrifying at the same time. I’ve been working with AWS for a while, and honestly, I still catch myself thinking about things the way they used to be, not how they actually work today. The problem is that AWS changes constantly, but a lot of the foundational stuff has evolved in ways that aren’t super obvious. https://okulbida.com/posts/aws-reinvent-2025-recap/ Tue, 23 Dec 2025 10:00:00 +0300 https://okulbida.com/posts/aws-reinvent-2025-recap/ Another year, another AWS re:Invent has come and gone. I’ve been following the announcements closely, and there’s a lot to cover. The Big Picture This year’s re:Invent felt a bit different. The pre:Invent announcements started later than usual (mid-November instead of early October), and the keynote felt more focused on GenAI than infrastructure improvements. That said, there are still plenty of practical enhancements that can make our lives easier. Security Features That Matter AWS Security Agent (Preview) This one caught my attention. https://okulbida.com/posts/aws-s3-storage-browser-access-grants/ Wed, 20 Nov 2024 18:00:00 +0300 https://okulbida.com/posts/aws-s3-storage-browser-access-grants/ It’s 2024, and AWS finally built a browser-based S3 viewer. Twenty years after S3 launched, you can now browse your buckets directly in the browser. It’s still in alpha, but hey, better late than never, right? You might be thinking - wait, weren’t there options before? Like S3Fox? Yeah, there were some third-party tools, but AWS itself never had an official browser interface. So what took so long? Real Problem: Access Control Turns out, building a simple file browser wasn’t the hard part. https://okulbida.com/posts/12-factors/ Wed, 08 May 2024 14:37:18 +0300 https://okulbida.com/posts/12-factors/ Disclaimer: here you might not find something new if you know 12 factors app. The 12-factor app methodology 12factor.net, is a set of principles designed to enable applications to be built with portability and resilience when deployed to the web. These principles focus on declarative formats for automation, clean contracts with the operating system, and suitability for deployment on modern cloud platforms, thus minimizing divergence between development and production, enabling continuous deployment for maximum agility. https://okulbida.com/posts/aws-elasticsearch-licensing/ Sun, 21 Apr 2024 21:25:08 +0300 https://okulbida.com/posts/aws-elasticsearch-licensing/ Recent elasticsearch licensing change ensures that the Beats modules are sending data to an officially supported versions of Elasticsearch and Kibana where Elastic can attest to the quality and scale of the products. Does AWS have any plans to fork a version filebeat? https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.13.html https://www.reddit.com/r/aws/comments/nn95aq/elastic_has_broken_filebeat_as_of_713_it_no/ What are the alternatives? Host elasticsearch on EC2 instances, why not? CloudWatch, slow… https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_ES_Stream.html Kubernetes options like ECK or helm chart deployments…tricky for production usage Loki? https://okulbida.com/posts/k8s-130-version/ Sun, 21 Apr 2024 14:42:59 +0300 https://okulbida.com/posts/k8s-130-version/ Reasons to upgrade to k8s 1.30 Container resource based autoscaling Container resource based autoscaling is now promoted to stable https://github.com/kubernetes/enhancements/issues/1610 Horizontal Pod Autoscaler examines the total resource usage of the entire pod i.e. sum of all containers and scale pods based on average CPU or memory usage. Container resource based autoscaling feature allows HPA to scale workloads based on the resource usage of individual containers within a pod, instead of the aggregated usage of all containers in the pod https://okulbida.com/posts/k8s-new-features/ Sat, 20 Apr 2024 23:25:05 +0300 https://okulbida.com/posts/k8s-new-features/ Kubernetes InPlacePodVerticalScaling feature Kubernetes v1.27 introduces InPlacePodVerticalScaling, allowing pod resource resizing without restarts This eliminates the downtime and potential data loss caused by pod restarts. It also helps avoid overprovisioning, since InPlacePodVerticalScaling lets you allocate resources precisely as needed In this example for pod memory resources configuration, the resizePolicy indicates that changes to the memory allocation require a restart of the container, and for CPU resources the restart is not necessary during resizing. https://okulbida.com/posts/terraform-best-practices/ Sat, 23 Mar 2024 19:11:15 +0300 https://okulbida.com/posts/terraform-best-practices/ Collaboration Use remote state and state locking For certain backends like AWS S3, enable versioning to make it easier to recover your state if needed Agree on naming convention Use meaningful tags to easily identify resources: environment, owner, project keys are must You can also add cloud-custdodian for components which are out of terrarfom/IaC tools, which could automatically tag your manually created resources with Owner Creator based on CloudTrail events Don’t reinvent the wheel Use existing shared and community modules. https://okulbida.com/posts/eks-instance-store/ Sat, 16 Mar 2024 17:00:51 +0200 https://okulbida.com/posts/eks-instance-store/ Userdata is compatible with the standard AWS EKS Terraform module, the only recommendation is to use a custom AMI. To use instance-store you also need to install local-static-provisioner - https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner Terraform example: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 eks-dev-instance-store = { instance_types = ["r6id. https://okulbida.com/posts/simple-rds-access/ Sat, 23 Dec 2023 16:37:19 +0200 https://okulbida.com/posts/simple-rds-access/ There are plenty of ways to access private RDS instances, and most need careful design. The one I use sometimes is simple: deploy it as a Helm chart inside a k8s cluster. Access to the RDS then depends on having access to the k8s cluster with the right RBAC. It’s not perfect, but it’s secure, quick to set up, and needs almost no maintenance. Here’s the basic idea: 1 socat TCP4-LISTEN:8888,fork TCP4:xxxxxxxx. https://okulbida.com/posts/helm-fix-after-k8s-upgrade/ Sat, 23 Dec 2023 16:27:22 +0200 https://okulbida.com/posts/helm-fix-after-k8s-upgrade/ After upgrading Kubernetes (k8s), you might encounter errors such as no matches for kind "Deployment" in version "apps/v1beta1". These errors typically indicate that certain resources have become deprecated. To resolve these issues without the need to delete your Helm chart, you can follow this simple solution: 1 2 3 helm plugin install https://github.com/helm/helm-mapkubeapis helm mapkubeapis <releasename> helm upgrade <releasename> You may still need to update your Helm chart templates, especially if there have been structural changes between versions. https://okulbida.com/posts/eks-expose-pods-through-cross-account-lb/ Sat, 23 Dec 2023 15:44:19 +0200 https://okulbida.com/posts/eks-expose-pods-through-cross-account-lb/ Expose Amazon EKS pods through cross-account load balancer https://aws.amazon.com/blogs/containers/expose-amazon-eks-pods-through-cross-account-load-balancer/ https://okulbida.com/posts/eks-access/ Sat, 23 Dec 2023 15:40:22 +0200 https://okulbida.com/posts/eks-access/ Simplified EKS access https://aws.amazon.com/about-aws/whats-new/2023/12/amazon-eks-controls-iam-cluster-access-management/ https://aws.amazon.com/blogs/containers/a-deep-dive-into-simplified-amazon-eks-access-management-controls/ https://github.com/hashicorp/terraform-provider-aws/issues/34982 https://okulbida.com/posts/loki-s3-dynamodb/ Wed, 26 Oct 2022 12:45:36 +0300 https://okulbida.com/posts/loki-s3-dynamodb/ While using Loki with S3 and Dynamodb it’s mandatory to add provision_config details as default might affect your budget https://grafana.com/docs/loki/latest/configuration/#provision_config 1 2 3 4 5 [provisioned_write_throughput: <int> | default = 3000] # DynamoDB table default read throughput. # CLI flag: -<prefix>.read-throughput [provisioned_read_throughput: <int> | default = 300] https://okulbida.com/posts/k8s-security-best-practices/ Sun, 07 Aug 2022 01:04:09 +0300 https://okulbida.com/posts/k8s-security-best-practices/ Keep the cloud provider platform secure Least privilege Secure traffic into cluster Run security test in development environments Mirror environments Cluster authentication & authorization Leverage OIDC for k8s authentication RBAC - define roles In cluster network/security/micro segmentation Prevent namespace-to-namespace communication Network policy Policy & Governance k8s admission controllers Read only Non-privileges ports Runtime security & monitoring https://okulbida.com/posts/bigdata-comparison-cloudproviders/ Wed, 21 Jul 2021 00:13:41 +0200 https://okulbida.com/posts/bigdata-comparison-cloudproviders/ https://okulbida.com/posts/db-cloudproviders/ Wed, 21 Jul 2021 00:12:44 +0300 https://okulbida.com/posts/db-cloudproviders/ https://okulbida.com/posts/aws-nat-gateway-no-need-igw/ Thu, 17 Jun 2021 12:15:17 +0300 https://okulbida.com/posts/aws-nat-gateway-no-need-igw/ You can now launch NAT Gateways in your VPC without associating an internet gateway to your VPC. Internet Gateway is required to provide internet access to the NAT Gateway. However, some customers use their NAT Gateways with Transit Gateway or virtual private gateway to communicate privately with other VPCs or on-premises environments and thus, do not need an internet gateway attached to their VPCs. More details: https://aws.amazon.com/about-aws/whats-new/2021/06/aws-removes-nat-gateways-dependence-on-internet-gateway-for-private-communications/ https://okulbida.com/posts/grafana-8-released/ Tue, 08 Jun 2021 23:09:58 +0300 https://okulbida.com/posts/grafana-8-released/ What’s new in Grafana v8.0 Grafana includes built-in support for Prometheus Alertmanager. Once you add it as a data source, you can use the Grafana alerting UI to manage silences, contact points as well as notification policies. A drop down option in these pages allows you to switch between Grafana and any configured Alertmanager data sources. https://grafana.com/docs/grafana/latest/datasources/alertmanager/ Prometheus metrics browser https://grafana.com/docs/grafana/latest/datasources/prometheus/#metrics-browser More details: https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v8-0/ https://okulbida.com/posts/aws-lb-controller-nlb-support/ Mon, 24 May 2021 16:16:34 +0300 https://okulbida.com/posts/aws-lb-controller-nlb-support/ https://aws.amazon.com/about-aws/whats-new/2021/05/aws-load-balancer-controller-version-2-2-available-support-nlb-instance/ https://okulbida.com/posts/aws-ec2-predictive-autoscaling/ Mon, 24 May 2021 16:14:25 +0300 https://okulbida.com/posts/aws-ec2-predictive-autoscaling/ Amazon EC2 Auto Scaling now natively supports Predictive Scaling so you can proactively scale out your Auto Scaling group to be ready for upcoming demand. Predictive Scaling can help you avoid the need to over-provision capacity, resulting in lower EC2 cost, while ensuring your application’s responsiveness. (Previously, Predictive Scaling was only available via AWS Auto Scaling Plans.) https://aws.amazon.com/about-aws/whats-new/2021/05/amazon-ec2-auto-scaling-introduces-predictive-scaling-native-scaling-policy/ https://okulbida.com/posts/awsekscoredns/ Mon, 24 May 2021 16:05:58 +0300 https://okulbida.com/posts/awsekscoredns/ Amazon Elastic Kubernetes Service (Amazon EKS) now supports using the Amazon EKS console, CLI, and API to install and manage CoreDNS and kube-proxy in addition to existing support for the Amazon VPC CNI networking plugin. https://aws.amazon.com/about-aws/whats-new/2021/05/eks-add-ons-now-support-coredns-kube-proxy/ https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html https://okulbida.com/posts/kubecon2021/ Sat, 15 May 2021 23:45:23 +0300 https://okulbida.com/posts/kubecon2021/ Full list of videos from KubeCon 2021 Europe https://www.youtube.com/playlist?list=PLj6h78yzYM2MqBm19mRz9SYLsw4kfQBrC https://okulbida.com/posts/aws-cloudfront-functions/ Fri, 07 May 2021 01:09:56 +0300 https://okulbida.com/posts/aws-cloudfront-functions/ AWS CloudFront functions is a nice alternative to Lambda@Edge https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale/ https://okulbida.com/posts/ec2-root-volume-replacing/ Fri, 30 Apr 2021 11:44:11 +0300 https://okulbida.com/posts/ec2-root-volume-replacing/ Amazon EC2 enables you to replace the root EBS volume for a running instance Limitations: You can’t replace the root volume if it is an instance store volume. You can’t replace the root volume for metal instances. More details: https://aws.amazon.com/about-aws/whats-new/2021/04/ec2-enables-replacing-root-volumes-for-quick-restoration-and-troubleshooting/ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-restoring-volume.html#replace-root https://okulbida.com/posts/aws-secrets-csi/ Tue, 27 Apr 2021 19:11:13 +0300 https://okulbida.com/posts/aws-secrets-csi/ How to use AWS Secrets & Configuration Provider with your Kubernetes Secrets Store CSI driver. One more example of kubernetes secrets management among vault, external-secrets and 1password operator 😅 https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/ https://okulbida.com/posts/grafana-license/ Tue, 27 Apr 2021 11:11:59 +0300 https://okulbida.com/posts/grafana-license/ Grafana was relicensed to AGPLv3 https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3/ https://okulbida.com/categories/ Mon, 01 Jan 0001 00:00:00 +0000 https://okulbida.com/categories/ https://okulbida.com/about/ Mon, 01 Jan 0001 00:00:00 +0000 https://okulbida.com/about/ about https://okulbida.com/archive/ Mon, 01 Jan 0001 00:00:00 +0000 https://okulbida.com/archive/ archive https://okulbida.com/search/ Mon, 01 Jan 0001 00:00:00 +0000 https://okulbida.com/search/ search