DevOps Daily with Fexingo: CI/CD, Kubernetes, and Modern Software Operations

Lucas and Luna dive into why rate limiting at the Kubernetes ingress layer is a critical, often overlooked practice for modern DevOps teams. They break down a real-world scenario: a startup whose API gateway collapsed under a traffic spike from a single misconfigured client, causing a cascading outage across microservices. Lucas explains the difference between application-level and ingress-level rate limiting, citing specific tools like NGINX Ingress Controller with annotations for requests per second and per-IP limits. He also covers the pitfalls of default configurations that allow unlimited traffic. Luna challenges the assumption that cloud load balancers handle this automatically, and they discuss how to set appropriate limits using Kubernetes annotations without breaking legitimate traffic patterns. The episode ends with a forward-looking question about traffic shaping and cost governance.

#Kubernetes #Ingress #RateLimiting #DevOps #NGINX #Microservices #CloudNative #SiteReliability #APIGateway #TrafficManagement #Observability #Startup #TechOperations #Infrastructure #ContainerOrchestration #DevOpsDaily #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily, Lucas and Luna dig into a quietly catastrophic antipattern: stuffing multiple containers into a single Kubernetes pod. They break down a real-world case where a monitoring stack with five containers per pod caused a production meltdown—crashing the main application container because a sidecar container leaked memory. They explain why the pod is not a lightweight VM, how resource isolation really works in Kubernetes, and why the industry is moving toward sidecar-less architectures. Lucas cites data from a 2025 CNCF survey showing that 42% of teams with multi-container pods reported at least one priority-1 incident caused by container resource fights. They also offer practical heuristics: one container per pod for stateless microservices, strict sidecar patterns for logging and proxies, and what to do when you genuinely need an init container. Plus, a small note on why this conversation made them think about how listener support keeps the show going.

#Kubernetes #Pods #Containers #SidecarPattern #Microservices #DevOps #CNCF #ProductionIncident #ResourceIsolation #ContainerOrchestration #CloudNative #Infrastructure #SiteReliability #Technology #FexingoBusiness #BusinessPodcast #DevOpsDaily #K8sBestPractices

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into the anti-pattern of stuffing multiple containers into a single Kubernetes pod. They trace the problem to early Docker Compose habits, explain why sidecar containers for logging and metrics are often the wrong choice, and walk through a real-world example where a team at a fintech startup saw pod startup times jump from 8 seconds to 47 seconds after adding a third container. They discuss the Kubernetes community's shift toward daemonsets and admission controllers to enforce pod container limits, and why the one-container-per-pod rule still holds in production. Along the way, they touch on resource requests vs limits, pod lifecycle hooks, and the surprising cost of init containers. The episode closes with a practical question every DevOps engineer should ask before adding that next container.

#Kubernetes #PodDesign #ContainerAntiPatterns #SidecarPattern #DevOps #CI/CD #PodLifecycle #InitContainers #ResourceRequests #ResourceLimits #AdmissionControllers #DaemonSet #Fintech #Startup #FexingoBusiness #BusinessPodcast #Technology #DevOpsDaily

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily, Lucas and Luna dig into Kubernetes audit logs — the overlooked data source that can save your organization from a compliance disaster. They walk through a real case of a fintech startup that caught an insider data exfiltration attempt only because they had enabled audit logging on their clusters. Lucas explains the three tiers of audit policies (Metadata, Request, and RequestResponse) and why most teams never get past the default Metadata level. Luna pushes back on the cost argument, pointing out that storing audit logs is cheap compared to the legal fees of a breach investigation. They also cover how to ship logs to an external SIEM, why you should never rely on Kubernetes etcd as a long-term log store, and a practical rule of thumb: turn on RequestResponse for any namespace handling PII or payment data. If you're running Kubernetes in production and haven't looked at your audit log configuration this quarter, this episode is for you.

#Kubernetes #AuditLogging #DevOps #Compliance #Security #Fintech #SIEM #etcd #PII #LogManagement #CloudNative #RBAC #ThreatDetection #InfrastructureAsCode #K8s #Business #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of DevOps Daily with Fexingo, Lucas and Luna dive into a critical but often overlooked failure point in container workflows: the moment an image hits your private registry. They unpack why scanners alone aren't enough, how a single unvetted pull can cascade into a cluster-wide CVE, and the concrete architecture change — a pre-pull vulnerability scan gate — that can catch supply-chain attacks before they deploy. Drawing on real-world examples from the recent PyTorch dependency confusion incident and a misconfigured JFrog Artifactory at a fintech unicorn, they explain how to wire Amazon ECR, Harbor, or GitLab container registry into your admission controller, and why blocking a build in CI doesn't protect you from a cached base image. If you've ever assumed your container registry was just a storage bucket, this episode will change how you think about your software supply chain.

#ContainerRegistry #VulnerabilityScanning #KubernetesSecurity #SoftwareSupplyChain #ImageAdmission #DevSecOps #DockerImageSecurity #AmazonECR #Harbor #GitLabContainerRegistry #CI/CDPipeline #CloudNative #KubernetesAdmissionController #PodSecurity #Technology #DevOpsDailyWithFexingo #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into Kubernetes Pod Security Admission — the successor to PodSecurityPolicies (PSPs) that's now mandatory in Kubernetes 1.25 and later. They break down the three built-in security levels (privileged, baseline, restricted), walk through a real-world migration from PSPs to PSA for a fintech company, and explain why most teams have misconfigured their admission webhooks. Lucas shares concrete examples of how a single mislabeled namespace can expose your cluster to container escape attacks, and Luna pushes back on the complexity of adopting restricted profiles for legacy workloads. They also discuss the operational impact: how PSA affects CI/CD pipelines, why you should test admission policies with dry-run mode, and the common gotcha around ephemeral containers. If you're running Kubernetes without validating your Pod Security Admission settings, your cluster is likely less secure than you think.

#Kubernetes #PodSecurityAdmission #PSA #PodSecurityPolicy #PSP #CloudNative #DevOps #ClusterSecurity #ContainerSecurity #K8sSecurity #SecurityPolicy #AdmissionController #Technology #BusinessPodcast #FexingoBusiness #TechOps #Compliance #KubernetesMigration

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna drill into a specific, overlooked compliance risk in modern software operations: unpatched base images in Docker registries. They walk through a real scenario from a fintech startup that failed a SOC 2 audit because a six-month-old Node.js base image contained known vulnerabilities. The hosts explain why most image scanning pipelines miss what matters, how distroless images change the risk profile, and why your Kubernetes cluster's image pull policy might be your biggest liability. They also share the one concrete change teams can make this week to reduce exposure. No theory — just a focused breakdown of a problem that's quietly costing companies time, money, and customer trust.

#Docker #Compliance #SOC2 #ImageScanning #Distroless #Kubernetes #DevOps #Security #VulnerabilityManagement #CI/CD #ContainerSecurity #Fintech #NodeJS #BaseImages #CloudNative #SoftwareOperations #FexingoBusiness #TechnologyPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 12 of DevOps Daily digs into Kubernetes RBAC misconfigurations — the single biggest compliance blind spot in most cloud-native environments. Lucas and Luna walk through a real incident at a mid-sized fintech where a single over-permissive ClusterRole let an attacker pivot to production data. They break down the principle of least privilege, how to audit your existing RBAC bindings with open-source tooling like kubectl-who-can and rbac-lookup, and why 'it worked in staging' is a dangerous justification for overly broad permissions. The conversation closes on whether policy-as-code tools like OPA/Gatekeeper are the right next step or just another abstraction layer. No clickbait, no fluff — just actionable DevOps ops intel.

#Kubernetes #RBAC #DevOps #CloudSecurity #Compliance #LeastPrivilege #FintechIncident #kubectlWhoCan #PolicyAsCode #OPAGatekeeper #ClusterRole #ProductionSecurity #PodIdentity #Tech #DevOpsDaily #FexingoBusiness #BusinessPodcast #CloudNative

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into the most critical and overlooked artifact in modern infrastructure: the Terraform state file. They explain why losing or corrupting state.json means losing control of your entire cloud estate. Using the real-world example of a 2024 incident where a major SaaS provider accidentally deleted its production state file during a migration, they walk through the anatomy of the failure, the three-hour outage that followed, and the operational changes that prevent it. They cover remote state backends, state locking with DynamoDB, partial configuration patterns, and the controversial practice of state file versioning. Listeners walk away knowing exactly how to audit their own state setup and what single command to run tonight to check if they're exposed.

#Terraform #InfrastructureAsCode #StateFile #SinglePointOfFailure #DevOps #CloudInfrastructure #IaC #HashiCorp #S3Backend #DynamoDB #StateLocking #BackupStrategy #IncidentResponse #DisasterRecovery #Technology #FexingoBusiness #BusinessPodcast #DevOpsDaily

Keep every episode free: buymeacoffee.com/fexingo

Episode 10 of DevOps Daily. Lucas and Luna dig into a problem every engineering team is facing in mid-2026: cloud CI costs spiralling out of control. They walk through a real example of a mid-stage startup whose GitHub Actions bill hit $14,000 in a single month because of one misconfigured matrix build. They discuss why cost caps are the missing control plane, how tools like Buildkite and self-hosted runners change the calculus, and why treating CI as an infinite resource is a cultural failure, not just a technical one. Practical, specific, and timely for any team running pipelines at scale.

#CI #CICD #CostOptimization #CloudCosts #GitHubActions #Buildkite #DevOps #SoftwareEngineering #PipelineOptimization #FinOps #InfrastructureAsCode #RunnerScaling #MatrixBuilds #TechOps #Technology #FexingoBusiness #BusinessPodcast #DevOpsDaily

Keep every episode free: buymeacoffee.com/fexingo