https://sk-santhosh.info/blogs Thoughts on DevOps, platform engineering, Kubernetes, cloud infrastructure and SRE. en Tue, 21 Jul 2026 00:00:00 GMT https://sk-santhosh.info/blogs/sandboxing-serverless-workloads-with-gvisor https://sk-santhosh.info/blogs/sandboxing-serverless-workloads-with-gvisor Tue, 21 Jul 2026 00:00:00 GMT A container is not a security boundary — every pod on a node shares one kernel. Adding gVisor to a pod-per-message serverless platform on Kubernetes: how runsc works, wiring RuntimeClass through Helm and an operator, and the loopback gotcha that breaks kubectl port-forward. Kubernetes Security gVisor Serverless https://sk-santhosh.info/blogs/from-branch-to-production-multi-env-deployment-automation https://sk-santhosh.info/blogs/from-branch-to-production-multi-env-deployment-automation Thu, 02 Jul 2026 00:00:00 GMT How I run 20+ developer environments plus testing, staging and production across two AWS accounts with one standalone deploy-pipeline repo whose workflow every microservice reuses — GitHub Actions building images, self-hosted runners reaching private EKS, and per-cluster Argo CD doing the syncs. On-demand dev deploys, auto-drafted releases and a branch-to-production promotion flow that never rebuilds the artefact. Kubernetes GitOps CI/CD Platform Engineering https://sk-santhosh.info/blogs/kubernetes-operator-spiffe-workload-registration https://sk-santhosh.info/blogs/kubernetes-operator-spiffe-workload-registration Mon, 29 Jun 2026 00:00:00 GMT In the previous post I registered SPIFFE entries by hand with spire-server entry create. Here I build a Kubernetes operator that automates it — a controller-runtime reconciler that watches Deployments and registers them with the SPIRE Entry API, finalizer cleanup and Prometheus metrics included. Kubernetes Go Operators Platform Engineering https://sk-santhosh.info/blogs/zero-trust-workload-identity-spiffe-spire https://sk-santhosh.info/blogs/zero-trust-workload-identity-spiffe-spire Mon, 29 Jun 2026 00:00:00 GMT Static API keys and shared secrets don't scale, and they all hit the Secret Zero problem. Here's how SPIFFE and SPIRE give every workload a short-lived, attested identity on Kubernetes — with working manifests, go-spiffe mTLS and the operational considerations the quickstarts skip. Kubernetes Security Zero Trust Platform Engineering https://sk-santhosh.info/blogs/beyond-200-ok-llm-traces-business-outcomes https://sk-santhosh.info/blogs/beyond-200-ok-llm-traces-business-outcomes Mon, 22 Jun 2026 00:00:00 GMT The application-level semantic layer of LLM observability: representing user intent, answer quality and business outcomes as telemetry on the trace, and correlating spans with eval results and feedback to see whether the AI served the user. AI Observability OpenTelemetry SRE https://sk-santhosh.info/blogs/implementing-slos-and-error-budgets https://sk-santhosh.info/blogs/implementing-slos-and-error-budgets Tue, 16 Jun 2026 00:00:00 GMT How to turn reliability from a gut feeling into a measurable, negotiated target — choosing good SLIs, setting honest SLOs, deriving an error budget and wiring up multi-window burn-rate alerts in Prometheus. SRE Reliability Observability Prometheus https://sk-santhosh.info/blogs/building-an-ai-platform-on-kubernetes https://sk-santhosh.info/blogs/building-an-ai-platform-on-kubernetes Sun, 14 Jun 2026 00:00:00 GMT Once three teams have each rebuilt GPU scheduling, model serving and RAG plumbing, you don't have an AI strategy — you have three. Here's how to turn that into one paved road on Kubernetes: a gateway, a serving layer, GPU compute and the cross-cutting concerns that make it production-grade. AI Kubernetes Platform Engineering MLOps https://sk-santhosh.info/blogs/observability-for-ai-applications-opentelemetry https://sk-santhosh.info/blogs/observability-for-ai-applications-opentelemetry Fri, 12 Jun 2026 00:00:00 GMT LLM apps fail in ways ordinary services don't — silent quality drops, runaway token costs, latency you can't explain. Here's how to instrument them with OpenTelemetry's GenAI conventions and see tokens, cost, latency and traces in Grafana. AI Observability OpenTelemetry Grafana https://sk-santhosh.info/blogs/zero-downtime-kubernetes-upgrades https://sk-santhosh.info/blogs/zero-downtime-kubernetes-upgrades Thu, 11 Jun 2026 00:00:00 GMT Kubernetes ships three releases a year and you can't skip them — here's how to keep clusters current without users ever noticing, covering version skew, pre-flight checks, workload readiness and a careful node rollout. Kubernetes Reliability SRE Platform Engineering https://sk-santhosh.info/blogs/running-spot-instances-in-production-safely https://sk-santhosh.info/blogs/running-spot-instances-in-production-safely Tue, 09 Jun 2026 00:00:00 GMT When spot instances are the right call, when not to use them at all, and how to keep a service available even as AWS reclaims nodes underneath it. A workload-by-workload model with the reasoning behind each decision. AWS Spot Instances Reliability Cost Optimisation https://sk-santhosh.info/blogs/reducing-kubernetes-costs-karpenter-spot https://sk-santhosh.info/blogs/reducing-kubernetes-costs-karpenter-spot Mon, 08 Jun 2026 00:00:00 GMT How we cut an EKS compute bill by roughly a third — replacing static node groups with Karpenter, running the stateless majority on spot and letting consolidation reclaim idle capacity, without trading away reliability. Kubernetes AWS Karpenter Cost Optimisation https://sk-santhosh.info/blogs/mcp-observability-assistant https://sk-santhosh.info/blogs/mcp-observability-assistant Sat, 06 Jun 2026 00:00:00 GMT Investigating incidents by asking questions in plain language — exposing Prometheus, Loki and Tempo as tools an AI assistant calls over the Model Context Protocol, instead of reaching for PromQL, LogQL and TraceQL. AI MCP Observability Platform Engineering https://sk-santhosh.info/blogs/building-a-rag-pipeline https://sk-santhosh.info/blogs/building-a-rag-pipeline Tue, 02 Jun 2026 00:00:00 GMT How retrieval-augmented generation grounds an LLM in your own data — chunking, embeddings, vector search with pgvector and generation with a self-hosted vLLM endpoint. AI RAG PostgreSQL Platform Engineering https://sk-santhosh.info/blogs/compliance-private-networking-aws-vpc https://sk-santhosh.info/blogs/compliance-private-networking-aws-vpc Tue, 26 May 2026 00:00:00 GMT How to design an AWS VPC that keeps workloads private, auditable and aligned with GDPR, ISO 27001 and PCI-DSS — using private subnets, VPC endpoints, flow logs and Terraform. AWS Networking Compliance Terraform https://sk-santhosh.info/blogs/apm-opentelemetry-grafana-tempo https://sk-santhosh.info/blogs/apm-opentelemetry-grafana-tempo Fri, 22 May 2026 00:00:00 GMT How to set up application performance monitoring using OpenTelemetry for instrumentation, Tempo for traces and Grafana for unified visibility. Observability OpenTelemetry Grafana Platform Engineering https://sk-santhosh.info/blogs/deploying-ai-models-on-kubernetes https://sk-santhosh.info/blogs/deploying-ai-models-on-kubernetes Tue, 19 May 2026 00:00:00 GMT A practical guide to running AI model inference workloads on Kubernetes with vLLM — resource limits, autoscaling and serving at scale. Kubernetes AI Platform Engineering DevOps https://sk-santhosh.info/blogs/kubernetes-cloudflare-private-networking https://sk-santhosh.info/blogs/kubernetes-cloudflare-private-networking Sun, 17 May 2026 00:00:00 GMT How to expose Kubernetes services securely using Cloudflare Tunnel and Zero Trust, with no open inbound ports. Kubernetes Cloudflare Networking Platform Engineering