Blog

One evening this week my wife showed me her phone and asked: is this you? She was looking at a Facebook post from the Romanian Embassy to the US. The embassy had shared a BBC World Service documentary called The teenagers who wired Romania. The banner photo is the one above. The one on the right, with the long hair, is me. As I remember it, I was guiding a cable. You can see a string, or another cable, tied to my left arm. The photo is from around 2003. I don’t know who took it, and until this week I had never seen it. ...

This site has run on Hugo with the PaperMod theme for a couple of years, free on GitHub Pages. It worked, and it looked like what it was: a personal blog with a logo in a circle and “All Things DevOps” under it. We wanted it to read like a firm, keep the zero hosting bill, keep the contact form and keep the blog. Instead of a weekend of CSS, we handed the repo and the live site to Claude Code and worked through it in one evening. ...

AI platform engineering is showing up in job titles, conference tracks and vendor decks, and it means something different in each one. For us it turned out to be two jobs behind one name: running LLM agents as production workloads, and letting agents operate the platform we already run. We have been doing both for a while now, with an internal knowledge bot that lives in Slack and coding agents that debug CI, review pull requests and bump vulnerable images. Here is what changed, what didn’t, and the lessons we learned along the way. ...

A while back we wrote about building a WordPress-as-a-service platform on AWS — ALB, EC2, ACM, Route 53, the works. It worked great. It also cost real money every month to serve a portfolio site that changes a few times a year, and it kept a PHP stack, a database, and a pile of plugins patched and reachable from the internet for no good reason. So we retired it. This is the story of moving stefaniapana.design from that setup to a static Hugo site on GitHub Pages, with one hard requirement: visitors must not be able to tell. Same design, same URLs, same lazy loading, same everything. Here’s how that went, including the gotchas that bit us on the way. ...

On the last Friday of July (this year, July 25, 2025), we celebrate System Administrator Appreciation Day to honour these silent guardians of our digital world. Sending good vibes and a massive high‑five to all the sudo scientists pulling on‑call rotations and hanging out in those late‑night Slack channels, keeping the world online. You’re the heartbeat of every business out there 😻 ref: https://sysadminday.com/

Proposal: Migration from Cluster Autoscaler to Karpenter for EKS Cluster Overview The most common approach to scaling Kubernetes clusters in AWS is to use Cluster Autoscaler (CA), which automatically adjusts the number of nodes based on pod resource requirements. However, CA has limitations when managing mixed-instance Auto Scaling Groups (ASG), leading to inefficiencies in scaling down nodes. To address these issues, we propose migrating to Karpenter, a Kubernetes-based node provisioning solution that offers advanced features like direct EC2 provisioning and customizability. This document outlines the technical steps, pros and cons, and migration plan for transitioning from Cluster Autoscaler (CA) to Karpenter in an EKS environment. The change aims to address inefficiencies in scaling down mixed-instance Auto Scaling Groups (ASG) and improve provisioning flexibility by leveraging Karpenter’s advanced capabilities. ...

Manually setting up PHP applications can be tedious and error-prone. By using AWS services and Terraform, we can automate our infrastructure setup, providing a scalable and secure environment for our PHP blog. This guide will walk we through a basic architecture, considerations, and common pitfalls. At the end, we’ll be able to host our blog with minimal effort and manage it like a pro. The Architecture The setup consists of the following components: ...

Optimizing Vault Costs with serviceaccount_name for Identity Aliases Hashicorp Vault SaaS bills on client usage, and a client is everything from a user to a machine. More on this here. The problem is that when a developer removes a chart and redeploys it, vault will count the Kubernetes ServiceAccount as a distinct new app, which isn’t quite true, because it’s the same app we had before and we were billed for. ...