-
On single-node Kubernetes, RollingUpdate can mount your database twice
With one replica, RollingUpdate starts the new pod before stopping the old, and on a single node both mount the same ReadWriteOnce volume. How I audited 123 Deployments, fixed 15 with zero downtime, and what really slowed Qdrant.
-
How my Kubernetes dashboard locked me out of my own SSO
Headlamp's backend retried a dead OIDC refresh token every 5 seconds with no backoff, and Authelia's per-IP rate limiter then blocked my own login. The wrong theory, the upstream race, a Helm drift landmine and the watchdog that caps it.
-
Secrets in GitOps history: scan by key name, then rotate
My Kubernetes manifests repo had credentials from its first commit. Why value-shaped scans drown in noise and still miss passwords, how key-name scanning with triage found the real ones, and why rotation, not deletion or history rewrites, is the fix.
-
My first restore test reported 0 tables and 0 errors
I had checked 49 backup sets for months but never restored one. The first test restored nothing and reported success. How to test Postgres restores safely, and three ways backups and restores quietly lie.
-
A 20-second power cut, an 8-hour outage: LUKS on a home server
My server lost power at 00:31, came back by itself, then waited 8 h 25 min at a hidden LUKS passphrase prompt. How to prove it from systemd timestamps, triage the cold-boot alert storm, and choose an unattended unlock.
-
Backups that lie, and the freshness alarm that catches them
My backup jobs reported OK while 13 of 17 databases had no backup, dumps were truncated and two crons had been dead for months. One freshness check over the artifacts of every backup set now catches all of it.
-
Search Console said 'connection error'. My router had banned Googlebot
Search Console reported connection errors while my web logs showed nothing wrong: my router's auto-ban list had caught two genuine Googlebot addresses. How I found it, and how to allowlist verified crawlers safely.