All posts
Certified Kubernetes Application Developer (CKAD) #6 Workloads 2: DaemonSet, StatefulSet
The sixth post in the Certified Kubernetes Application Developer (CKAD) series. It covers the workload controllers beyond Deployment — DaemonSet and StatefulSet — from a hands-on perspective. We will build the DaemonSet that places one Pod on every node, and the StatefulSet that needs a stable network ID and ordering guarantees, in YAML all the way down to the headless Service and volumeClaimTemplates.
Certified Kubernetes Security Specialist (CKS) #4: RBAC least privilege in depth (Cluster Hardening)
The fourth post in the Certified Kubernetes Security Specialist (CKS) series. On top of the RBAC you learned in CKA, we layer the principle of least privilege and go deep, from a security angle, on how to find and narrow Roles that are too broad. We cover the danger of wildcard verb/resource, removing default ServiceAccount permissions, cutting ClusterRoleBinding overuse down with RoleBinding, the gotchas of aggregated ClusterRole, identifying dangerous permissions like secrets get, pods/exec, escalate, bind, and impersonate, and the flow of verifying narrowed permissions with kubectl auth can-i --as.
How Does Email Get Delivered? SMTP, Spam Filters, and SPF/DKIM
This post explains, without any code, how email reaches the recipient and why some mail is classified as spam. It covers the relay between mail servers, the SPF and DKIM that verify the sender, and how a spam filter decides, at a non-developer's level.
Python Data Analysis #1: Getting Started with pandas — Notebooks and the DataFrame
pandas is the Python library for working with tabular data. We set up a notebook environment with uv, build Series and DataFrame objects by hand, and kick off this seven-part data analysis series.
Red Hat Certified Engineer (RHCE) #3: Config Files and Connectivity — ansible.cfg, ssh, become
The third post in the Red Hat Certified Engineer (RHCE) series. We lay out the lookup precedence and key settings of ansible.cfg, which governs how Ansible behaves, the procedure for setting up SSH key-based connections with ssh-copy-id, and how to escalate privileges with become. We build a per-project ansible.cfg and become configuration by hand — a perennial exam favorite — and check the connection.
AWS Certified Developer - Associate (DVA-C02) #1 Exam Introduction — Exam Structure and Study Roadmap
The first post of the AWS Certified Developer - Associate (DVA-C02) series. It covers the exam structure (65 questions, 130 minutes, a 720 passing line), the weight and meaning of the four domains (Development 32% , Security 26% , Deployment 24% , Troubleshooting and Optimization 18%), how it differs from the Solutions Architect Associate (SAA-C03), and a study strategy that turns the hands-on feel built on the [AWS practical track](/en/posts/aws-basics-1-account-region-az) into exam questions from a developer's point of view. This 15-part series aims to help you pass DVA-C02, ending with a full-scale mock exam in #15.
AWS Certified Solutions Architect - Associate (SAA-C03) #12 Domain 3-4 High-Performing Architectures — Choosing a DB
The final post of the SAA-C03 high-performing domain. It covers the decisive difference between RDS's Multi-AZ (high availability) and read replicas (read scaling), cloud-native Aurora (auto storage scaling , Global , Serverless), NoSQL DynamoDB (capacity modes , global tables , DAX), Redshift for analytics, and the criteria for choosing a database by workload.
Certified Kubernetes Administrator (CKA) #10 Workloads 1: Deployment in Depth, ReplicaSet, Rolling Update and Rollback
The tenth post in the Certified Kubernetes Administrator (CKA) series. We look deep into the Deployment, the workload an operator handles most often. We walk through the Deployment→ReplicaSet→Pod hierarchy and the label selector that binds them, how to create and scale with kubectl, the conditions under which the rollingUpdate strategy (maxSurge/maxUnavailable) guarantees a zero-downtime update, and the rollback that lets you track versions and revert with kubectl rollout — all drilled until they are second nature.
Certified Kubernetes Application Developer (CKAD) #5 Workloads 1: Deployment, ReplicaSet, Rolling Update, and Rollback
The fifth post in the Certified Kubernetes Application Developer (CKAD) series. We create a Deployment imperatively—the heart of app delivery—and lay out the relationship and scaling of Deployment, ReplicaSet, and Pod. We will get hands-on with the meaning of rollingUpdate's maxSurge and maxUnavailable, the flow of shipping a new version with kubectl set image, and the rollback scenario of tracking state with kubectl rollout and reverting a failed version with undo.
Certified Kubernetes Security Specialist (CKS) #3: CIS benchmark (kube-bench), component security, Ingress TLS, binary verification
The third post in the Certified Kubernetes Security Specialist (CKS) series. It covers the remaining half of the Cluster Setup domain — hardening the cluster itself. We get hands-on, with commands and manifests, on what the CIS Kubernetes benchmark is, how to inspect the control plane and nodes with kube-bench and read the PASS/FAIL/WARN results and apply remediation, the procedure for changing dangerous apiserver and kubelet flags to safe values, how to attach TLS to an Ingress, and the flow for verifying a downloaded binary with sha256sum.
How Are Domain Names Bought and Sold? Registration, WHOIS, and Renewal
This post explains, without any code, how you buy, own, and keep a domain name, from a transactional angle. It covers why a domain is closer to a lease, what a registrar and WHOIS are, and what happens when you miss a renewal, at a non-developer's level.
Python Automation #7: Building Your Own Command — Packaging a CLI with typer and rich
Closing out the series by bundling the automation scripts into a single CLI with typer, polishing the output with rich, and installing it with uv tool install as a command you can call from anywhere.