Kubernetes

the little robot stands guard at a doorway like a friendly bouncer, holding up a hand to check a stack of papers, while the boy in the cap watches; a shield symbol floats above them, protective and watchful

🔒 Building a PII Guardrail Proxy for Cloud LLM Calls

A local model classifies every prompt before it leaves the cluster. If it’s sensitive, it’s blocked. If it’s clean, it goes to NVIDIA NIM. 150 lines of FastAPI, deployed on k3s.

the robot pressing an inking stamp down onto a sheet of text, blacking out several lines into redaction bars, while the boy in the cap holds the page steady and a padlock sits on the table beside them

🕵️ Privacy-Preserving LLM Pipelines: Anonymize Before You Send

Replace PII with semantically realistic fakes before sending to a cloud LLM, then restore the originals from the response. Started with a general model and prompt engineering — then upgraded to a purpose-built 1.7B fine-tune via Ollama.

the boy in the cap holding a tablet showing four small line charts, connected by a single cable plugged into a port on the robot's chest

📈 Observing Local LLM Inference: llama.cpp's Built-in Prometheus Metrics

llama.cpp’s inference server ships a /metrics endpoint. One flag, Prometheus scraping, a Grafana dashboard loaded via ConfigMap sidecar — AI observability without a proxy layer.

the boy in the cap holding up a small processor chip toward the robot, who reaches out to it with an open hand; behind them a plain desktop computer and blank monitor sit on a desk

🤖 Local LLM Inference on Kubernetes, No GPU Required

A CPU-only self-hosted LLM stack running on k3s: llama.cpp as the inference server, Open WebUI as the chat interface, deployed as a single Git push.

the robot standing behind crossed hazard-striped barrier tape while the boy in the cap looks at it through a magnifying glass, one hand on his chin, thinking rather than reaching in

🚨 Don't Restart the Node. Quarantine It First.

Rebooting a misbehaving node feels productive. It isn’t. You’re erasing your evidence and skipping the lesson.

the boy in the cap sliding a fresh brick into a standing wall while the robot, holding a wrench, pulls a worn brick out from the other side, the wall staying up throughout

⚡ Your Deployment Causes 30 Seconds of Downtime. What Went Wrong?

Kubernetes rolling updates don’t give you zero-downtime for free. There are four separate things you have to get right, and most clusters get at least one wrong.

the boy in the cap holding a shield marked with a no-entry symbol, blocking a spiky cube of gears and skulls from crossing into a framed panel on the right, where the robot with a wrench watches the same spiky cube become a smooth plain block

🔄 Someone kubectl apply'd a Hotfix Directly. How Do You Detect and Prevent It?

Manual kubectl in production is the Kubernetes equivalent of SSH’ing into a server and editing files. It works until it doesn’t, and when it doesn’t, nobody knows why.

the boy in the cap kneeling on a floating stone island, laying a single arched bridge across to another island; behind them a brick wall with one small gate, the robot standing on the far side, and broken bridge pieces discarded to the right

🛡️ How Do You Prevent a Compromised Pod From Calling Your Database?

Default Kubernetes is a flat network. Every pod can reach every other pod. In a cluster with ten services, that’s ten potential blast radiuses instead of one.

the boy in the cap dropping a code card into a slot in a small git-marked box, which is joined by a single hose to a larger cube marked with the git and Kubernetes symbols; the robot watches from the left

🔑 Deploy to Kubernetes Without Storing Any Cluster Credentials in CI

A common interview question in 2026. If your answer is ‘kubeconfig in a CI secret’, you’re not wrong — but you’re also not getting the job.

the robot turning a key in the dial of a large safe door marked with a cloud, drawing a small scroll out along an arrow toward the boy in the cap, who holds an open cardboard box marked with a padlock ready to receive it

🤫 How Do You Handle Secrets in a GitOps Repository?

GitOps says Git is the source of truth. Secrets say don’t put them in Git. These two things appear to be in direct conflict. They’re not.