Learn DevOps, Kubernetes & AWS — Simplified
Practical tutorials, deep dives, and battle-tested guides for engineers who build and ship in the cloud.
By KP | TZoneLabs | DevOps & Cloud Engineering Our AWS bill for a new EKS environment came in nine times higher than the month before, and nothing about our traffic had changed. The entire difference was NAT Gateway data processing — a private-subnet VPC with no Gateway Endpoint for S3 was routing every ECR … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering We went looking for a 45-day-old database backup during an incident review and it wasn’t there. Not corrupted, not slow to restore — gone. An S3 lifecycle rule meant to clean up old application logs had been silently deleting backups for over a month, because both … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering The default Horizontal Pod Autoscaler config scales on raw CPU with no stabilization window, which is exactly why it’s common to see replica counts bounce up and down every few minutes under normal, slightly-uneven traffic. The two settings that actually decide whether HPA is useful or … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering A scheduled quarterly rotation replaced the database credential in Secrets Manager, and within minutes most of the fleet was using it without issue. Two hours later, a subset of pods started failing every query with authentication errors — pods that hadn’t restarted in weeks, still holding … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering Someone changed a security group in the console to unblock themselves during an incident, and it never made it back into the .tf file. Terraform doesn’t know that happened until the next apply either quietly reverts it or, worse, doesn’t touch it because nothing in the … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering A Role scoped to one namespace, bound to one service account, with verbs limited to exactly what that workload does, is what turns Kubernetes RBAC into an actual security boundary instead of a checkbox. Most clusters we’ve audited get this half right: the Role exists, but … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering A payments-team service started timing out on calls to a shared internal API, intermittently, with nothing in either side’s logs pointing at why. No connection refused, no TLS error, no 5xx. Just a hang until the client’s own timeout gave up. The pods were healthy, the … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering A dynamic environment: block in .gitlab-ci.yml turns every merge request into its own deployed, reachable review app, and turns every closed merge request into a cleanup job that tears it back down. Reviewers stop asking “can you deploy this so I can look at it” and … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering Every deploy of one gRPC service left about 5% of calls failing for the next 30 to 40 seconds, then it cleared up on its own. The rollout itself looked clean, every new pod passed its readiness probe on schedule. The failing calls were connecting to … Read more
By KP | TZoneLabs | DevOps & Cloud Engineering Installing Cluster Autoscaler is one Helm command. Getting it to scale up fast enough and scale down without evicting something it shouldn’t is the part that takes actual configuration. The defaults are conservative on purpose, and left untouched they either leave pending pods waiting longer than … Read more