AI models now read our Ansible roles, Terraform modules and libraries more than we do. What they need is what we always needed: types, units, side effects and examples.

Public TLS certificates drop to 47 days by 2029. Where renewal on VMs breaks, and how to automate it safely for Kafka, Cassandra and web servers.

A UK region doesn't put your data beyond the US CLOUD Act or US sanctions. See what breaks if your account goes, and how to keep keys and a copy outside.

ingress2gateway converts HTTP Ingress but misses the tcp-services ConfigMap behind Cassandra, Kafka and ClickHouse. Rebuild it with TCPRoute and TLSRoute.

Encrypt each .env value with OpenBao Transit, give CI encrypt-only and apps decrypt-only access, and rotate keys without redeploying.

Replace long-lived AWS access keys with short-lived STS credentials from OpenBao that expire on their own, and keep the root key out of reach.

Swap static database passwords for dynamic credentials: users created on request and dropped when the lease ends. How we run it on OpenBao and Vault.

Most teams leaving Vault Enterprise only use features OpenBao and free Vault already have. The hard part is configuration, so we built a tool to migrate it.

You no longer need to know a language to ship code in it. That doesn't make every language an equally good bet.

When PID 1 in a container isn't your workload, Kubernetes only sees what the wrapper reports. Where that goes wrong and how to make process death visible.

Racks and data centres decide where every copy of your Cassandra data lives. A practical guide to getting the topology right before the first node starts.

How Kafka tiered storage moves closed segments to object storage: what it changes, the plugins you supply, enabling it per topic and what it costs.

Extending our open-source Datadog alternative with ClickHouse for traces and logs, Grafana Pyroscope for profiling, and new terraform-k8s-monitoring features.

Turn one hardened golden image into a fully configured, environment-specific node on first boot with cloud-init, systemd and vals, with no configuration drift.

Escape rising VMware costs by migrating virtual machines to license-free open-source alternatives like KVM, libvirt, or KubeVirt v1.8 on bare metal.

A practical guide to hardening your software supply chain using Cosign, Kyverno, Harbor, SHA digests, and SBOMs.

Self-hosting a monitoring stack on Kubernetes is more cost-effective, private, and scalable

A practical engineering guide to future-proofing server access by enabling ML-KEM hybrid post-quantum key exchange in OpenSSH 9.9 and 10.0.

How We Mastered AI-Assisted Development: Planning, Agents, and the Power of CLAUDE.md

Kubernetes CNI-native WireGuard encryption versus a VM-level WireGuard underlay: the technical differences, pros and cons, and how to choose for your cluster.

Strimzi automates Kafka on Kubernetes and AxonOps adds deep observability. Together they make a production-ready stack for running and monitoring Kafka.

A blueprint for multi-DC Apache Cassandra across sovereign European infrastructure, using a WireGuard mesh for data autonomy and vendor-neutral security.

Achieve European cloud sovereignty by mastering multi-cloud routing with OSPF.

Mesh networks provide a resilient, scalable, and cost-effective alternative to traditional VPNs

Build immutable server images with Packer and Ansible instead of patching live boxes over SSH, for more secure, repeatable infrastructure.

In an era where proprietary licensing can threaten operational stability, OpenBao emerges as a vendor-neutral alternative for secrets management.

Stop managing certificates manually. Learn how to automate Kubernetes SSL/TLS for Ingress and internal services using cert-manager, Vault, and OpenBao.

Deploy a production-ready Prometheus, Grafana, Mimir, Loki and Tempo monitoring stack on a single AWS VM with a pre-configured AMI and setup wizard.

Manual processes create deployment bottlenecks, errors and knowledge loss. Why we automate nearly everything, and where we draw the line.

Skip hours of Kubernetes setup with a pre-configured AWS AMI that gives developers a ready-to-use sandbox, development and training environment.

Discover how OpenBao, the open-source alternative to HashiCorp Vault, delivers secure, community-driven secrets management.

The Kubernetes features we were waiting for, including in-place pod resizing and native sidecar containers, and what they change for performance and security.

Ditch the SaaS bill and take control of your data! This post walks you through building your own powerful observability platform using open-source tools

As large language models (LLMs) become more powerful and complex, efficiently running them for real-world applications is increasingly challenging.

Kubernetes makes it easy to overspend. Where the hidden costs come from and practical ways to downscale clusters and control your cloud bill.

The built-in ones are good for most use cases. They are pretty granular covering access to Rancher itself down to individual projects or…

We’re going to look at how to manage network policies in Kubernetes with Calico.

An introduction to Kubernetes Network Policies: how to isolate workloads and control pod-to-pod traffic, with practical examples you can apply.

Introducing vals-operator — an opensource tool for managing secrets in Kubernetes

Learn about capacity planning in Kubernetes with Vertical Pod Autoscaler

Plan for losing Rancher: create an emergency service account and kubeconfig so you can still reach the Kubernetes API when Rancher is down.

Terraform is a brilliant tool to manage Infrastructure as Code we at Digitalis both love and hate in equal measure.

At Digitalis we have embraced SUSE Rancher and became Gold partners with SUSE Rancher. Do you want to know why? Keep reading.

Want some security tips and context for cloud-native platforms in financial services?

I’ve been using Amazon MSK for some time and today I encountered an interesting problem with autoscaling. Read more to find out!

The core stack Digitalis uses to build and run Kubernetes for customers: Terraform, Rancher, Vault, ArgoCD, Traefik, Linkerd, OpenTelemetry and more.

How we remove static database passwords with HashiCorp Vault dynamic credentials and the vals-operator DbSecret, so access expires within an hour.

Highlights from KubeCon + CloudNativeCon Europe 2022 in Valencia: OpenTelemetry, service mesh, eBPF, GitOps, operators, data on Kubernetes and cost.

Vals-Operator 0.6.2 syncs secrets from external stores into Kubernetes secrets. This release updates core libraries and adds secret templates.

How to add AxonOps monitoring to Apache Cassandra running on Kubernetes with the k8ssandra operator, from agent install to the dashboard.

Rotate Apache Cassandra SSL certificates often using HashiCorp Vault as the CA and consul-template, reloading SSL without restarting nodes.

Why Karpenter is now a default on our EKS clusters: right-sized node provisioning, better use of spot instances, and the trade-offs to know.

Cloud is fast to start but expensive for data workloads. We compare price and performance of cloud, bare metal and hybrid, and how to choose.

How we secure Kubernetes ingresses with mutual TLS using Traefik TLSOptions, cert-manager and HashiCorp Vault, plus the gotchas we hit.

Secure external access to a Strimzi Kafka cluster on Kubernetes using Traefik ingress and your own certificate authority instead of self-signed certificates.

Why monitoring is harder than it looks, from a managed services team that runs it daily: the common traps and what good monitoring needs.

Takeaways from KubeCon + CloudNativeCon EU 2023 in Amsterdam: OpenTelemetry, GitOps, data on Kubernetes, service mesh and the Gateway API.

Running PostgreSQL on Kubernetes with the CloudNative-PG operator: what works well, what is missing, and how it fared in operational testing.

A DevOps look at CockroachDB as a PostgreSQL alternative for a multi-region AWS project: clustering, users, backups and missing features.

Keep Terraform DRY across multiple environments: how we structure code for clouds, Cloudflare, Kubernetes and more without copy-pasting.

How to run Kubernetes on-premises or in the cloud without a cloud load balancer, and how to handle ingress, with a working code example.

A working CloudFront and Lambda configuration for adding CORS headers to S3 content, and the misleading errors the AWS examples produce.

Build hardened custom Linux VM images for AWS and Azure with Packer to speed up deployments and meet security standards such as PCI-DSS.

Following our Kubernetes approach, how we run containers on AWS ECS without load balancers by using Cloudflare to route traffic.

Back to basics with SSH: using SSH agent for key management, proxying connections through jump hosts, and security best practices.

Mount a Google Cloud Storage bucket inside a Kubernetes pod to get scalable, durable storage and save on block storage costs. Step-by-step setup.

How a managed services team switches safely between many customer workloads and environments without running commands against the wrong one.

Why log collection is more than a compliance checkbox, and how we collect logs to gain insight into security, performance and reliability.

Kubernetes is no longer just for tech giants. A step-by-step approach to modernising your application with Kubernetes, whatever your company size.

Pasting company data into public AI tools carries real risk. What can go wrong with AI and LLMs, and how to protect your organisation's data.

US politics and tariffs are prompting organisations to rethink hosting. European cloud options beyond the hyperscalers and what to consider before moving.

Our simpler standard for collecting metrics, traces and logs: why we moved away from the legacy model and what a lean observability setup looks like.

Moving Kubernetes to bare metal? Choose between bare metal and VMs, then deploy with Rancher, K3s, Kubespray, Kops or kubeadm. Tips for beginners.

This blog looks at how to use Molecule to test roles in isolation, as no one is perfect and we all make mistakes but many can be avoid with careful planning.

How to deploy Apache Cassandra on Kubernetes with AxonOps management tool. AxonOps provides the GUI management for the Cassandra cluster.

How to manage Ansible projects with version control: approaches to versioning playbooks and roles, and handling dependencies across projects.

Ansible variable scope and precedence can surprise you. A real scenario where a playbook picked an unexpected value, and how to predict which wins.