Posts

I have just finished Phase 4 of my vLLM-on-Kubernetes project: a tiny model, a Helm chart, a validation ladder run from my laptop over WireGuard. The pod was Ready. The deployment had rolled out successfully. The health endpoint returned two hundred, over and over, hundreds of times in the logs. Inference still took eight minutes. Not eight minutes to deploy. Eight minutes for a single chat completion — the kind of request that would be one curl in a normal API. The platform looked fine. The workload was not. ...

I finished Phase 3 of the same project that gave me Phase 2 — and the post about when the script says done, not the agent. Phase 2 proved the cluster exists: private node, kubeadm, Cilium, smoke workload, survives reboot. Phase 3 proved something narrower and, for what comes next, more important: I can admin that cluster from my laptop over WireGuard, without opening an EC2 Instance Connect tunnel every time I want to run kubectl. ...

I recently finished Phase 2 of a personal project: a single-node Kubernetes cluster on AWS, built greenfield with Terraform, Packer, Ansible, and kubeadm. Most of the typing happened in Cursor, with an agent proposing diffs and me approving or rejecting them. Several times the conversation reached a tone I now recognize as dangerous: “This should work.” “Phase 2 is essentially complete.” “You can mark this done.” I did not mark it done. I ran the check script instead. ...

Part 3 of a series on sizing a private AKS cluster: Part 1 — node pools and VM SKUs · Part 2 — ephemeral OS and a sizing table Parts 1 and 2 fixed three node pools, Ddsv5-class SKUs, and ephemeral OS sizes. I still had to answer: can a /26 subnet survive cluster autoscaler max on all pools, and what happens when Azure runs out of Intel VMs in a region? Networking choice: Azure CNI + Cilium + overlay I went with Azure CNI powered by Cilium in overlay mode: ...

Part 2 of a series on sizing a private AKS cluster: Part 1 — node pools and VM SKUs · Part 3 — Cilium overlay, IP math, and capacity In Part 1 I split the cluster into system, platform, and apps pools and picked D-family SKUs with a d for local temp disk. This post is the disk strategy, the full sizing table, and the Intel vs AMD vs v6 decisions that fed it. ...

Part 1 of a series on sizing a private AKS cluster: Part 2 — ephemeral OS and a sizing table · Part 3 — Cilium overlay, IP math, and capacity I needed to size a private AKS cluster from scratch: not just “how many nodes,” but which node pools, which Azure VM family, and which exact SKU for system components, platform charts, and application workloads. This post is what I settled on for pool topology and VM family/SKU naming. Parts 2 and 3 cover ephemeral OS disks and networking/capacity. ...

cert-manager is excellent at keeping TLS certificates fresh—until you build a small internal PKI on top of it. Then a quiet renewal of your root CA can take down webhooks, operators, and anything that still trusts an old ca.crt bundled next to a perfectly valid leaf certificate. I ran into this class of failure around External Secrets Operator and its validating webhook. The symptom was familiar: CrashLoopBackOff, logs stuck on certificate validation, cluster-wide inability to create ExternalSecret resources. The root cause was stranger: the CA had been renewed, but downstream secrets had not. ...

Context I had the need to allow Power BI to connect to a PostgreSQL database running in Kubernetes, fronted by Traefik using a TCP entrypoint. At first, I hoped to terminate TLS at Traefik, the same way you’d do for HTTPS traffic. But this turned out not to be possible with standard PostgreSQL clients (psql, libpq, psycopg, etc.). Here’s why. Why This Happens Unlike HTTPS, PostgreSQL does not start a TLS handshake immediately. Instead, a libpq/psql client first sends a special SSLRequest packet: ...

Vim extension in Cursor, Zed, or VS Code on macOS — arrow keys and held hjkl don’t repeat. macOS disables key repeat for some Electron apps by default. Fix: disable ApplePressAndHoldEnabled for the app (keeps accent popup off, enables key repeat). Get the app’s bundle ID: osascript -e 'id of app "Cursor"' # or "Zed" or "Visual Studio Code" Enable key repeat for that app: defaults write <BUNDLE_ID> ApplePressAndHoldEnabled -bool false Examples: ...

🧭 Why Build a Homelab? I recently completed the first phase of my cloud-native homelab — a Kubernetes cluster on AWS built from scratch with kubeadm, provisioned using Terraform, Packer, Ansible, and Cilium. This wasn’t just for fun (though it was). I designed this homelab as: A hands-on way to prepare for the CKA certification A platform to host real-world workloads later A personal sandbox to understand what’s happening under the hood, not just run kubectl apply ...