The big moments in Jothia and Jovery's life

Chasing headroom for one more node under a fixed budget: reading the Azure bill precisely, a disk-billing surprise that reverses an earlier decision, bounding the k3s control-plane heap with GOMEMLIMIT, and why reserved instances were a dead end on this subscription.

Moving metrics off the cluster to a managed backend while keeping a light collector, validating a rewritten scrape config without touching production, and right-sizing the pieces that were quietly wasting resources: CPU throttling on idle pods and an unbounded controller heap.

Self-hosting the metrics pipeline on a small cluster: why VictoriaMetrics over Prometheus, adapting scraping to k3s where the control plane is a single process, cutting ingest by ninety percent, and a memory incident that took the whole GitOps loop down with it.

The finale: a disaster-recovery model where only one key is precious, an 8-step rebuild runbook verified twice, a cross-region migration, how to actually read the Azure bill, and trimming cost by swapping disk tiers.

The reusable patterns that make new apps a copy-paste: a stateless static-site template, the shared-Postgres pattern, Headlamp delegating RBAC to the API server, keeping a password manager stateless with a sealed RSA key, and Miniflux OIDC plus an Azure Postgres extension gotcha.

One login for every app: a lightweight LDAP directory (LLDAP) plus Authelia doing both forward-auth and OIDC, global default-protect with a bypass list, provisioning 2FA without email, and the three authentication patterns you end up mixing.

Why I keep state out of the cluster: the storage landscape for Kubernetes, what local-path really costs you, one shared managed Postgres with a database per app, why no Redis, and a three-way storage strategy.

How to put encrypted secrets directly in Git with SealedSecrets: how the asymmetric sealing works, sealing and handing off a secret, and the one key you must back up offline or lose everything.

One wildcard certificate for every subdomain via cert-manager and ACME DNS-01, writing a custom webhook solver when your DNS provider has none, serving it everywhere with a Traefik default TLSStore, and making Traefik itself highly available.