Kubernetes on DevOps & Rock'N'Roll

Wrapping Kyverno policies into a chart you can actually tune

Tue, 07 Jul 2026 00:08:30 +0000

Kyverno’s policy library is excellent and you should read it. It is also a directory of static YAML files, which means adopting it looks like copying twenty ClusterPolicy manifests into your GitOps repo and then editing them by hand, per cluster, forever.

That works until the second cluster. Dev wants audit where prod wants enforce. The infra cluster needs the CRI socket policy relaxed because your monitoring agent legitimately mounts it. A new namespace needs to be excluded from the Flux label requirement. Each of these is a one-line change to a file that’s now duplicated across three repositories, and none of them are visible from a single place.

IRSA to Pod Identity: notes from the migration

Tue, 02 Jun 2026 00:08:30 +0000

IRSA has been the way to give a Kubernetes pod an AWS identity since 2019, and it works. It also requires an OIDC provider per cluster, a trust policy per role that names a specific cluster’s OIDC issuer, and a mental model involving projected service account tokens that you re-derive from scratch every time something breaks.

EKS Pod Identity does the same job with less machinery. I’ve now moved a few clusters over and it’s mostly good news, with a couple of edges worth knowing before you start.

A FluxCD repo layout that survives forty applications

Tue, 05 May 2026 00:08:30 +0000

Every GitOps repository starts beautiful. One cluster, five apps, a flat apps/ directory, and a Kustomization that reconciles the lot. Then the second cluster appears. Then staging needs a different replica count. Then somebody needs their own namespace with their own RBAC and no access to anyone else’s. Six months later you are grepping through forty kustomization.yaml files trying to work out why a change to a shared ConfigMap took down two environments.

Node labels for Node Exporter alerts

Wed, 04 Mar 2026 00:08:30 +0000

Running a multipurpose Kubernetes cluster where production, dev and infra workloads share the same infrastructure is pretty common. In such a setup, you often want your alerting rules to be smarter: fire a critical alert when a prod node is burning CPU, but keep it informational for a dev node. To do that, you need your Prometheus metrics to carry environment context. This post shows how to thread that label all the way from a Karpenter node pool down to the Prometheus alert.

Yet another Vault story

Fri, 06 Oct 2023 00:08:30 +0000

One can find a million blog posts about various aspects of using Hashicorp Vault, this solution has truly received massive adoption. So now you don’t even question what you’re going to use as secrets storage, but the matter is more of “how”.

Being a complete and inveterate gitops’er, one of my primary objectives is to store as much as I can in Git and to deploy that into Kubernetes. This brought me to the BanzaiCloud Bank Vaults solution bundle that allows you to achieve exactly this. It provides the ability to configure Vault as a Custom Resource and store all its primary settings on a repository. This is not very far from the official Helm chart deployment with their values, but BanzaiCloud give you a bit more: