Kubernetes

cartoon cover for: Observing Local LLM Inference: llama.cpp's Built-in Prometheus Metrics

📈 Observing Local LLM Inference: llama.cpp's Built-in Prometheus Metrics

llama.cpp’s inference server ships a /metrics endpoint. One flag, Prometheus scraping, a Grafana dashboard loaded via ConfigMap sidecar — AI observability without a proxy layer.

cartoon cover for: Local LLM Inference on Kubernetes, No GPU Required

🤖 Local LLM Inference on Kubernetes, No GPU Required

A CPU-only self-hosted LLM stack running on k3s: llama.cpp as the inference server, Open WebUI as the chat interface, deployed as a single Git push.

cartoon cover for: Don't Restart the Node. Quarantine It First.

🚨 Don't Restart the Node. Quarantine It First.

Rebooting a misbehaving node feels productive. It isn’t. You’re erasing your evidence and skipping the lesson.

cartoon cover for: Your Deployment Causes 30 Seconds of Downtime. What Went Wrong?

⚡ Your Deployment Causes 30 Seconds of Downtime. What Went Wrong?

Kubernetes rolling updates don’t give you zero-downtime for free. There are four separate things you have to get right, and most clusters get at least one wrong.

cartoon cover for: Someone kubectl apply'd a Hotfix Directly. How Do You Detect and Prevent It?

🔄 Someone kubectl apply'd a Hotfix Directly. How Do You Detect and Prevent It?

Manual kubectl in production is the Kubernetes equivalent of SSH’ing into a server and editing files. It works until it doesn’t, and when it doesn’t, nobody knows why.

cartoon cover for: How Do You Prevent a Compromised Pod From Calling Your Database?

🛡️ How Do You Prevent a Compromised Pod From Calling Your Database?

Default Kubernetes is a flat network. Every pod can reach every other pod. In a cluster with ten services, that’s ten potential blast radiuses instead of one.

cartoon cover for: Deploy to Kubernetes Without Storing Any Cluster Credentials in CI

🔑 Deploy to Kubernetes Without Storing Any Cluster Credentials in CI

A common interview question in 2026. If your answer is ‘kubeconfig in a CI secret’, you’re not wrong — but you’re also not getting the job.

cartoon cover for: How Do You Handle Secrets in a GitOps Repository?

🤫 How Do You Handle Secrets in a GitOps Repository?

GitOps says Git is the source of truth. Secrets say don’t put them in Git. These two things appear to be in direct conflict. They’re not.

cartoon cover for: Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

🔐 Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

No open ports. Real TLS at home. One IngressRoute per app. This is the networking setup I landed on after ruling out everything that required a compromise.

cartoon cover for: My Homelab Runs on GitOps. Here's What That Actually Means.

🏗️ My Homelab Runs on GitOps. Here's What That Actually Means.

I wanted to learn production-grade Kubernetes patterns without breaking production. One node, a full GitOps stack, and a hard rule: no manual kubectl after bootstrap.