All posts
K8s Advanced #2: RBAC / ServiceAccount in Depth — Aggregated ClusterRole / Impersonation / IRSA / Workload Identity
[Intermediate #7](/en/posts/k8s-intermediate-7) covered the four RBAC objects and the ServiceAccount model. On top of that, there's more depth encountered in operational clusters. Aggregated ClusterRole that makes ClusterRoles extensible by composing them via labels, Impersonation that temporarily acts as another user's permission, the flow where ServiceAccount tokens shifted from legacy secrets to projected tokens, and EKS's IRSA and GKE's Workload Identity that tie K8s ServiceAccounts to cloud IAM — one more layer of the permission model in depth.
Modern Python Advanced #7 Performance — cProfile, py-spy, Memory Profiling
A toolbox for finding and fixing slow Python code — timeit, cProfile, py-spy, line_profiler, memray, and common optimization patterns.
RHEL Advanced #5: Security Hardening — auditd, OpenSCAP, FIPS
The three pillars of operational security stacked on top of SELinux. auditd for recording every change to the system with ausearch/aureport, OpenSCAP for automated checking and remediation against CIS, STIG, PCI-DSS, and FIPS mode required by government and financial certifications — all in one cycle.
TypeScript Advanced #3: Conditional types and infer
The if statement of the type level — the distributive behavior of T extends U ? X : Y and the patterns that pull values out of a type with infer. Build ReturnType and Awaited yourself.
Angular Advanced #4 RxJS in depth — custom operators and Schedulers
On top of the RxJS basics from Intermediate, we cover the advanced topics that actually make a difference in practice. Higher-order Observables, concurrency-control operators, custom operators, Schedulers, and marble testing.
AWS Advanced #5: EventBridge / SQS / SNS
The three side by side, SNS topic / SQS queue / EventBridge bus,rule, fan-out patterns, FIFO vs Standard, DLQ and idempotency, how it all wires up to Lambda / ECS — AWS messaging infrastructure.
Django Advanced #4: Caching — per-view / template fragment / low-level
From Redis backend setup to cache_page, template fragments, low-level cache.set/get, ETag, and stampede — every layer of Django caching.
Docker in Practice #5 Pushing to Registries and Tag Strategy — The :latest Trap
Picking a registry (GHCR vs Docker Hub vs ECR) and tag strategy. Why :latest is dangerous in production, where semver and SHA tags belong, immutable tags, retention policies, and image size management — sorting out what comes after the push.
K8s Advanced #1: CNI in Depth — Calico / Cilium / eBPF
The first post in the K8s Advanced series. In [Intermediate #7](/en/posts/k8s-intermediate-7), one line was left while covering NetworkPolicy: "the manifest is K8s standard, but actually blocking traffic is the CNI plugin's job." This post unfolds that one line. What CNI is, how the same K8s manifest runs differently on Calico vs Cilium, and how eBPF redraws the data plane — all in one cycle.
Modern Python Advanced #6: Advanced typing — Variance, ParamSpec, Self, overload
Next step from intermediate typing — covariance/contravariance, ParamSpec and Concatenate, Self, TypeGuard/TypeIs, and @overload.
RHEL Advanced #4: SELinux Advanced — Writing Policy and audit2allow
Going one level higher than the intermediate post: the structure of .te/.fc/.if policy files, the flow and limits of generating modules with audit2allow, the procedure to compile and install with checkmodule / semodule_package / semodule by hand, plus booleans and interfaces — all in one cycle. The goal is to follow an AVC denial all the way through to a permanent policy module.
TypeScript Advanced #2: Mapped types
Mapped types that transform an entire object type — how Partial/Required/Readonly are built, plus key remapping (as) and modifiers (+/-).