I'm super excited and honoured to be named an AWS Hero today!! Thank you so much to everyone who helped me along the way! Thanks Taylor Jacobsen, Corey Strausman and so many others... lckhd.eu/UHoVKv

Using multiple Availability Zones (AZs) is a good way to build for redundancy, but it also means extra costs as you get charged when data flows across them. With random load balancing and spread-out replicas, each hop has a very good chance of leaving the AZ. The article discusses some approaches to help, including IP-mode ALB targets, a hard topology spread, and using Karpenter instead of per-service node groups. In the use case described, costs fell over 60% using these approaches. Check this from Ayoub Reda. lckhd.eu/BA7JQ1 #Kubernetes #AmazonEKS #Karpenter #Istio #FinOps

Having good monitoring is key to a successful platform running in the cloud. There are many tools out there you can use for Kubernetes monitoring on AWS with the Elastic Kubernetes Service (EKS) but one good combo involves using Prometheus, Grafana, Alertmanager, Node Exporter, and kube-state-metrics. The example below shows the setup of these. The example from Vinaymanjunath walks through some failure scenarios like CrashLoopBackOff, replica mismatches, and pending pods as well as the main steps for setup. It also shows how to write alert rules and route everything through to Slack. A useful troubleshooting section on PVCs stuck pending due to a missing default StorageClass is there too. lckhd.eu/l4p22e #EKS #Kubernetes #Prometheus #Grafana #Alertmanager

One of the nice parts about Kubernetes is that it’s always improving, with new releases every few months. It does make work for teams to upgrade, but it’s usually worth it to get the latest and greatest. Seeing what’s involved in upgrading is always interesting, and Marcin Cuber puts together great guides on this. This edition discusses the 1.36 to 1.37 upgrade on Amazon Elastic Kubernetes Service (EKS). It’s organized into eight gated stages, each with its own approval. The Metrics API graduates to v1, but the 1.37 HPA controller still reads v1beta1, and an eventRecordQPS of 0 now means unlimited. There are also special considerations for Auto Mode and SELinux. lckhd.eu/inMixj #AmazonEKS #Kubernetes #Terraform #PlatformEngineering

Kubernetes has many concepts to understand. Many of these make sense alone but get tangled the moment you put them together. One area like this is scheduling, preemption, eviction, QoS, PriorityClass, and PDB. The article below attempts to pull them apart and show where each one actually applies. Tanat Lokejaroenlarb framed it as: for any Pod being removed or placed, ask who is making the decision and why. Once you separate the actor (scheduler vs kubelet vs API server) from the reason, a lot of the usual confusion goes away. Check it out! lckhd.eu/H1VivW #Kubernetes #scheduling #pdb

Firecracker is intentionally feature-light. There are a lot of alternatives with richer feature sets (notably QEMU), many of which predate Firecracker. But small has its advantages, both in security and density.

Anyone who has worked with Kubernetes has likely dealt with pods stuck in ContainerCreating. The reason behind this usually lives several layers deeper than most of us look. The article below traces the actual path kubelet follows before a single application container is allowed to run. The article discusses what a pod sandbox really is, why the pause container exists to hold Linux namespaces, and how the CNI chain (ptp, host-local, portmap) sets up networking in stages that can quietly fail in very different ways. This from Yuvraj Singh Bhadoria is worth the read. Check it out! lckhd.eu/Daf9IV #Kubernetes #Security #Fundamentals #Networking

312 – preview.mailerlite.io/previe… • How to Find Resilience Bugs in Systems that Don't Exist • Evolutionary #Architecture in Practice • Everything I know about good system design • How the @ClaudeDevs Code team does code review • System Design and Behavioral Intelligence book

There is a certain level of security by default for pods in Elastic Kubernetes Service (EKS) clusters in AWS, but many are surprised that all pods can talk to all other pods. Other things that may surprise people are that containers can run as root, and that you can give an app AWS access by just using the worker node role, which gives that access to every pod on the node. In the article below, some controls are set up to harden this default behaviour, including IAM Roles for Service Accounts (IRSA), default-deny NetworkPolicies, restricted Pod Security, and using Secrets Manager via the CSI driver. Check this out from Someswar Duddi. lckhd.eu/kUKbeP #AWS #EKS #Kubernetes #Security #IAM

After almost 4 years it’s time to take a trip back home to Serbia! ❤️ With all the immigration waiting and woes I am very excited to see my family again! Gonna make a couple of stops while I’m there! So if you are in Vienna, join me for a meetup on the 20th and if you are in Ljubljana, I’ll see you at the AWS Community Day Adria on the 22nd! 🤩

Managing custom microservices in Kubernetes often means endless YAML, manual scaling, and constant ConfigMap tweaks. Operators can help with these and automate a lot of that. Operators are typically written with Go but this article shows you can build one in Python instead. The kopf framework is used to build a working operator in under 100 lines. It covers defining a CRD, writing the reconciliation logic, running it locally against your cluster, and then containerizing it for deployment. Code samples are included as well to try out for yourself. Qing has put together a good starting guide that can help get you running something quickly. lckhd.eu/vHmI6g #Python #Kubernetes #Operator #kopf

Teams rarely swap a CNI in their Kubernetes clusters for fun. The usual trigger is needing real visibility into east-west traffic and a stronger network policy story, since AWS VPC CNI leaves pod-to-pod flows largely opaque and policy enforcement thinner than some security postures require. The blog below covers a zero-downtime move from AWS VPC CNI to Cilium on EKS using blue/green node migration, labels as isolation boundaries, ENI IPAM with prefix delegation, native routing, and kube-proxy replacement via eBPF for the end state. Ravindu Fernando wrote this article and it's an interesting read if your team is ever considering a migration like this. It includes some of the things you need to watch out for as well. lckhd.eu/48SGMx #Kuberentes #EKS #CNI #Cilium

Don't Forget we are doing an X Space today on the new AWS Lambda Web Functions. Join @ASpittel (host), @julian_wood, @samrat_karak, and myself as we get in to the nitty gritty of it! 10 AM PT, right here on X!

Many systems require more than one agent to be able to effectively handle complex tasks and decide between a large number of tools to use. When agents need to interact with each other, a protocol like A2A can be used. AgentCore Runtime is a place you can run your agents and it supports A2A. The example here involves multiple agents with an orchestrator and specialists interacting using A2A on AgentCore Runtime. Application errors are received as JSON-RPC errors with HTTP 200, and a 424 usually indicates a container failure. Purnanga Borah discusses some of the limits of what A2A can handle. lckhd.eu/Jx6COD #AmazonBedrock #AgentCore #A2A #AWS

Container-based solutions are widely used and this is really just about building images with business logic. Most are familiar with how to take their code and package it in a container image but to maximize security and $$$s, being able to optimize images is key. You can just keep adding more layers in your images to get all the tools and libraries you need and you can even build components from source during the process but all of this adds extra size, files and more that gets rolled up into the final image. These could contain more security vulnerabilities and will waste you time pushing the data around on container loads. Saquib Khan offers some great tips on optimizations you can do. lckhd.eu/dylnFg #Docker #Containers #FinOps