- GovCloud Bedrock: The Model Graveyard
- Emaigenesis
- The zombie Java app serving internet scrapers for five years
- I answered 114 AWS Well-Architected Review questions from my terminal
- I replaced the AWS CLI completer with a datalake
- FinOps portfolio: 71 tickets over 5 years
- I was wrong about shell completions for 15 years
- Three holes in the partition wall
- Bananas Acquisition: a CMMC CRM playbook
- The Redshift Bug I Mistook for Postgres
- Every AI session starts from zero. Mine doesn’t.
- Do not fake smallness
- One module block per service per tenant
- Every tool I’ve ever used is a CloudFormation frontend
- Newspapers aren’t dead. You read one every morning.
- from feature_flags import *
- The Allow SCP that worked until it didn’t
- The $233 Day, Part 2: The Inference Iceberg
- The $173 Training Run
- The missing layer in compliance RAG: why your search results need a judge
- Your employees are tenants and you should bill them like it
- AI coding tools assume single-threaded users
- I assumed GovCloud was AWS with a different region code. It took two weeks to prove me wrong.
- I debugged a Lambda timeout for 6 hours. The fix was 4 CLI commands.
- Recovering Claude Code sessions from history.jsonl after index corruption
- From eight manual steps to one command
- Your onboarding flow is your architecture’s report card
- Zero-touch multi-tenant deploys: removing myself from the critical path
- Why we removed aws-for-fluent-bit from EKS
- Per-Tenant CloudWatch Log Isolation on EKS, or: Why I Stopped Using aws-for-fluent-bit
- When a namespace owns your deployment
- The IAM policy controls access — the document controls how people feel about it
- Stop copying AWS managed policies — deny what you don’t want instead
- Kubeflow is a version matrix, not a version
- Drift is an availability bug
- An orderly EKS and Kubeflow upgrade path
- IAM trust policies silently accept wildcards in principals — and silently deny everything
- IAM eventual consistency is 4 seconds — if your policy still doesn’t work, you have a bug
- The Over-Mighty Subject: why your site repos have too much power
- I replaced $489/mo in AWS Client VPN with a $3 t4g.nano running Headscale
- Making a Kopf operator idempotent: three-layer existence checks and the redisReady race
- I assumed model conversion worked like compilation. It doesn’t.
- Self-healing race conditions: when your CI/CD fails on purpose
- Expression injection in GitHub Actions repository_dispatch — and the one-line fix
- Your CI/CD dispatch token can rewrite your infrastructure code
- Cross-repo auto-deploy with GitHub Actions: the orchestrator pattern
- Your terraform apply is silently rolling back your container images
- Terraform module for multi-provider DNS: define once, deploy to Route53 + Cloudflare
- ElastiCache auth-token to RBAC migration has a Terraform provider bug
- Amazon WorkSpaces are invisible to SSM and CloudWatch (and how to fix it)
- SimpleAD is Samba 4 — you can create users with ldapadd instead of ClickOps
- What building infrastructure for a startup actually looks like
- 90 AWS resources in 5 minutes — automating multi-tenant SaaS tenant lifecycle
- Your ACM certificate request is a beacon — scanners are watching Certificate Transparency logs
#acm
#active-directory
#ai
#airflow
#ansible
#api-gateway
#archaeology
#automation
#aws
#bash
#bedrock
#career
#ci-cd
#claude-code
#cli
#cloudflare
#cloudwatch
#cmmc
#compliance
#control-tower
#data-engineering
#debugging
#design
#developer-experience
#devops
#dns
#duckdb
#ecr
#edge
#eks
#elasticache
#eso
#finops
#fluent-bit
#github-actions
#govcloud
#headscale
#helm
#iam
#incident
#incident-response
#jetson
#kopf
#kubeflow
#kubernetes
#lambda
#litellm
#llm
#logging
#metacontroller
#ml-ops
#mlops
#multi-tenant
#nist
#nvidia
#oncall
#pgvector
#platform-engineering
#platformengineering
#postgres
#productivity
#python
#rag
#rbac
#recovery
#redis
#redshift
#reliability
#route53
#saas
#scp
#security
#shell
#ssm
#team
#tensorrt
#terraform
#versioning
#vpc
#vpn
#wellarchitected
#wireguard
#workflow
#workspaces
#zsh