A 45-second container shutdown sounds harmless until it costs you a production database connection pool. Lucas and Luna explore why most Kubernetes pods ignore SIGTERM, how a missing preStop hook turned a routine deployment into a 15-minute outage for a European payments platform, and the three-line fix that cuts pod termination from 30 seconds to under one second. They drill into the mechanics of the Linux process lifecycle inside containers, show why sleep 30 in a preStop hook is a common anti-pattern, and walk through a concrete health-check-aware shutdown sequence using Kubernetes 1.27's new pod status conditions. Listeners walk away with a specific checklist they can apply to any deployment tomorrow morning.

#Kubernetes #PodLifecycle #GracefulShutdown #SIGTERM #preStopHook #ContainerOrchestration #DevOps #SiteReliability #ProductionIncident #LinuxProcesses #PodTermination #CloudNative #Technology #FexingoBusiness #BusinessPodcast #SoftwareEngineering #Infrastructure #Observability

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dig into the mechanics of Kubernetes Horizontal Pod Autoscaler — specifically why it often fails to keep up with sudden traffic spikes. They walk through a real-world scenario from a retail platform that saw request latency spike from under 100ms to over 2 seconds during a flash sale. The root cause wasn't resource limits or cluster size — it was the default HPA scaling metrics and cooldown windows. Lucas explains how target CPU utilization, stabilization windows, and custom metrics interact, and why relying solely on CPU-based HPA leaves you vulnerable. They discuss the alternative: using Kubernetes Event-driven Autoscaling (KEDA) with request-based metrics. If you're running Kubernetes in production and haven't stress-tested your HPA configuration, this episode will save you from a late-night incident.

#Kubernetes #PodAutoscaling #HPA #KEDA #SiteReliabilityEngineering #CloudNative #DevOps #IncidentResponse #Scalability #Microservices #Containers #ProductionEngineering #TrafficSpikes #Metrics #Technology #FexingoBusiness #BusinessPodcast #DevOpsDaily

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into why rate limiting at the Kubernetes ingress layer is a critical, often overlooked practice for modern DevOps teams. They break down a real-world scenario: a startup whose API gateway collapsed under a traffic spike from a single misconfigured client, causing a cascading outage across microservices. Lucas explains the difference between application-level and ingress-level rate limiting, citing specific tools like NGINX Ingress Controller with annotations for requests per second and per-IP limits. He also covers the pitfalls of default configurations that allow unlimited traffic. Luna challenges the assumption that cloud load balancers handle this automatically, and they discuss how to set appropriate limits using Kubernetes annotations without breaking legitimate traffic patterns. The episode ends with a forward-looking question about traffic shaping and cost governance.

#Kubernetes #Ingress #RateLimiting #DevOps #NGINX #Microservices #CloudNative #SiteReliability #APIGateway #TrafficManagement #Observability #Startup #TechOperations #Infrastructure #ContainerOrchestration #DevOpsDaily #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily, Lucas and Luna dig into a quietly catastrophic antipattern: stuffing multiple containers into a single Kubernetes pod. They break down a real-world case where a monitoring stack with five containers per pod caused a production meltdown—crashing the main application container because a sidecar container leaked memory. They explain why the pod is not a lightweight VM, how resource isolation really works in Kubernetes, and why the industry is moving toward sidecar-less architectures. Lucas cites data from a 2025 CNCF survey showing that 42% of teams with multi-container pods reported at least one priority-1 incident caused by container resource fights. They also offer practical heuristics: one container per pod for stateless microservices, strict sidecar patterns for logging and proxies, and what to do when you genuinely need an init container. Plus, a small note on why this conversation made them think about how listener support keeps the show going.

#Kubernetes #Pods #Containers #SidecarPattern #Microservices #DevOps #CNCF #ProductionIncident #ResourceIsolation #ContainerOrchestration #CloudNative #Infrastructure #SiteReliability #Technology #FexingoBusiness #BusinessPodcast #DevOpsDaily #K8sBestPractices

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into the anti-pattern of stuffing multiple containers into a single Kubernetes pod. They trace the problem to early Docker Compose habits, explain why sidecar containers for logging and metrics are often the wrong choice, and walk through a real-world example where a team at a fintech startup saw pod startup times jump from 8 seconds to 47 seconds after adding a third container. They discuss the Kubernetes community's shift toward daemonsets and admission controllers to enforce pod container limits, and why the one-container-per-pod rule still holds in production. Along the way, they touch on resource requests vs limits, pod lifecycle hooks, and the surprising cost of init containers. The episode closes with a practical question every DevOps engineer should ask before adding that next container.

#Kubernetes #PodDesign #ContainerAntiPatterns #SidecarPattern #DevOps #CI/CD #PodLifecycle #InitContainers #ResourceRequests #ResourceLimits #AdmissionControllers #DaemonSet #Fintech #Startup #FexingoBusiness #BusinessPodcast #Technology #DevOpsDaily

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily, Lucas and Luna dig into Kubernetes audit logs — the overlooked data source that can save your organization from a compliance disaster. They walk through a real case of a fintech startup that caught an insider data exfiltration attempt only because they had enabled audit logging on their clusters. Lucas explains the three tiers of audit policies (Metadata, Request, and RequestResponse) and why most teams never get past the default Metadata level. Luna pushes back on the cost argument, pointing out that storing audit logs is cheap compared to the legal fees of a breach investigation. They also cover how to ship logs to an external SIEM, why you should never rely on Kubernetes etcd as a long-term log store, and a practical rule of thumb: turn on RequestResponse for any namespace handling PII or payment data. If you're running Kubernetes in production and haven't looked at your audit log configuration this quarter, this episode is for you.

#Kubernetes #AuditLogging #DevOps #Compliance #Security #Fintech #SIEM #etcd #PII #LogManagement #CloudNative #RBAC #ThreatDetection #InfrastructureAsCode #K8s #Business #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily with Fexingo, Lucas and Luna dive into a critical but often overlooked failure point in container workflows: the moment an image hits your private registry. They unpack why scanners alone aren't enough, how a single unvetted pull can cascade into a cluster-wide CVE, and the concrete architecture change — a pre-pull vulnerability scan gate — that can catch supply-chain attacks before they deploy. Drawing on real-world examples from the recent PyTorch dependency confusion incident and a misconfigured JFrog Artifactory at a fintech unicorn, they explain how to wire Amazon ECR, Harbor, or GitLab container registry into your admission controller, and why blocking a build in CI doesn't protect you from a cached base image. If you've ever assumed your container registry was just a storage bucket, this episode will change how you think about your software supply chain.

#ContainerRegistry #VulnerabilityScanning #KubernetesSecurity #SoftwareSupplyChain #ImageAdmission #DevSecOps #DockerImageSecurity #AmazonECR #Harbor #GitLabContainerRegistry #CI/CDPipeline #CloudNative #KubernetesAdmissionController #PodSecurity #Technology #DevOpsDailyWithFexingo #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into Kubernetes Pod Security Admission — the successor to PodSecurityPolicies (PSPs) that's now mandatory in Kubernetes 1.25 and later. They break down the three built-in security levels (privileged, baseline, restricted), walk through a real-world migration from PSPs to PSA for a fintech company, and explain why most teams have misconfigured their admission webhooks. Lucas shares concrete examples of how a single mislabeled namespace can expose your cluster to container escape attacks, and Luna pushes back on the complexity of adopting restricted profiles for legacy workloads. They also discuss the operational impact: how PSA affects CI/CD pipelines, why you should test admission policies with dry-run mode, and the common gotcha around ephemeral containers. If you're running Kubernetes without validating your Pod Security Admission settings, your cluster is likely less secure than you think.

#Kubernetes #PodSecurityAdmission #PSA #PodSecurityPolicy #PSP #CloudNative #DevOps #ClusterSecurity #ContainerSecurity #K8sSecurity #SecurityPolicy #AdmissionController #Technology #BusinessPodcast #FexingoBusiness #TechOps #Compliance #KubernetesMigration

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna drill into a specific, overlooked compliance risk in modern software operations: unpatched base images in Docker registries. They walk through a real scenario from a fintech startup that failed a SOC 2 audit because a six-month-old Node.js base image contained known vulnerabilities. The hosts explain why most image scanning pipelines miss what matters, how distroless images change the risk profile, and why your Kubernetes cluster's image pull policy might be your biggest liability. They also share the one concrete change teams can make this week to reduce exposure. No theory — just a focused breakdown of a problem that's quietly costing companies time, money, and customer trust.

#Docker #Compliance #SOC2 #ImageScanning #Distroless #Kubernetes #DevOps #Security #VulnerabilityManagement #CI/CD #ContainerSecurity #Fintech #NodeJS #BaseImages #CloudNative #SoftwareOperations #FexingoBusiness #TechnologyPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 12 of DevOps Daily digs into Kubernetes RBAC misconfigurations — the single biggest compliance blind spot in most cloud-native environments. Lucas and Luna walk through a real incident at a mid-sized fintech where a single over-permissive ClusterRole let an attacker pivot to production data. They break down the principle of least privilege, how to audit your existing RBAC bindings with open-source tooling like kubectl-who-can and rbac-lookup, and why 'it worked in staging' is a dangerous justification for overly broad permissions. The conversation closes on whether policy-as-code tools like OPA/Gatekeeper are the right next step or just another abstraction layer. No clickbait, no fluff — just actionable DevOps ops intel.

#Kubernetes #RBAC #DevOps #CloudSecurity #Compliance #LeastPrivilege #FintechIncident #kubectlWhoCan #PolicyAsCode #OPAGatekeeper #ClusterRole #ProductionSecurity #PodIdentity #Tech #DevOpsDaily #FexingoBusiness #BusinessPodcast #CloudNative

Keep every episode free: buymeacoffee.com/fexingo