https://1shubham7.blog/posts/ Recent content in Posts on Shubham Singh Hugo -- gohugo.io en-us https://1shubham7.blog/helm-features-for-sres/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/helm-features-for-sres/ Twenty-five Helm flags, template functions, chart features and tools that most daily users never touch, each with the operational problem it solves. Written after two years of writing and managing Helm packages in production. https://1shubham7.blog/spec-driven-multi-agent-workflow/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/spec-driven-multi-agent-workflow/ A spec-driven workflow for Claude Code agents: a numbered spec that gets attacked before any code, checks set up before features, three roles with walls between them, a PreToolUse hook that enforces the rules, and injected bugs to grade the tests. Written after running it once and logging every confident mistake. https://1shubham7.blog/agent-evals/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/agent-evals/ Normal code has tests; agents need evals. What an eval harness is, the vocabulary that goes with it, how I would build one in Go for an SRE agent working against Kubernetes, why pass^k matters more than pass@k for ops, the tools that exist (and the one OpenAI is shutting down), the ways a harness's numbers lie to you, and the habits that keep a suite useful. https://1shubham7.blog/agent-harness/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/agent-harness/ What an agent harness actually is, where the word comes from, and the dozen or so primitives hiding inside the term. A companion to the loop engineering post. https://1shubham7.blog/ebpf/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/ebpf/ What eBPF actually is, why the verifier means it can't crash your kernel, hooks and maps in plain words, two runnable examples with bpftrace and libbpf, and how Cilium turns all of it into a CNI. https://1shubham7.blog/helm-hooks/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/helm-hooks/ What Helm does with a hook step by step, the three things hooks do not do that everyone assumes they do, a migration Job that survives a rollback, and when an initContainer or an Argo CD sync wave is the better tool. Written after two years of writing and managing Helm packages in production. https://1shubham7.blog/log-collection-and-labels/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/log-collection-and-labels/ A container log line on disk contains no idea which pod wrote it. Everything you filter by later is constructed by the collector at collection time. What the file actually looks like, how collectors find it, where every label comes from, and why that design decides the health of your logging stack. https://1shubham7.blog/configmap-restart/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/configmap-restart/ Why a changed ConfigMap restarts nothing, the Helm checksum annotation done properly, the two mistakes that make it silently do nothing, and when an immutable ConfigMap, Reloader, or a reload sidecar is the better tool. Written after two years of writing and managing Helm packages in production. https://1shubham7.blog/rust-for-sres/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/rust-for-sres/ I learned enough Rust in a weekend to read, review and debug the CLIs, API clients and daemons that show up in infra work. This is the subset that mattered, the compiler errors you will actually hit, and the parts of the language I deliberately skipped. https://1shubham7.blog/claude-code-loops/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/claude-code-loops/ What loop engineering actually means, where the term came from, and how /loop and /goal turn Claude Code into something that babysits deployments and works until the tests pass. https://1shubham7.blog/system-one-models-jev/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/system-one-models-jev/ Most LLM calls in a backend are structured decisions dressed up as chat. TypeSafe's Jev answers only that kind of question: typed answers with probabilities, in one pass, with no text generation. What it is, how its confidence numbers work, what 'can't hallucinate' does and does not mean, the open-source alternatives that appeared within weeks, and where an SRE would put one. https://1shubham7.blog/layer-under-kubernetes/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/layer-under-kubernetes/ Which of my Kubernetes-shaped SRE instincts are about the abstraction and which are about the machine underneath, worked out against a hosting company that runs about 12,000 single-tenant VMs across ten cloud providers with no Kubernetes at all. https://1shubham7.blog/victoriametrics-stack/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/victoriametrics-stack/ VictoriaMetrics started as a remote storage backend for Prometheus and grew into a full monitoring stack. What Prometheus deliberately does not do, why two HA Prometheus replicas are not a cluster, how VictoriaMetrics splits Prometheus's jobs into components and keeps long-term data without object storage, how VictoriaLogs compares with Loki and VictoriaTraces with Tempo and Jaeger, what else the project ships, and when it is the right choice. https://1shubham7.blog/what-i-learned-reading-the-cyber-resilience-act/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/what-i-learned-reading-the-cyber-resilience-act/ I read the whole of Regulation (EU) 2024/2847, every article and every annex, and mapped KubeAid and LinuxAid against it for my employer. These are the things that surprised me, the mental model I ended up with, and what I would tell the next engineer who has to do the same reading. https://1shubham7.blog/linux-concepts/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/linux-concepts/ Processes and signals, namespaces and cgroups, memory, storage, networking, and identity: the mechanism behind each, the two or three ways it breaks under a pod, and the one check that confirms it. Written from on-call across 100+ production Kubernetes clusters. https://1shubham7.blog/cnp-antipatterns/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/cnp-antipatterns/ Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny. https://1shubham7.blog/loki-production-checklist/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/loki-production-checklist/ Deployment mode, object storage, label cardinality, multi-tenancy and auth, cross-cluster shipping, and the failures that are silent rather than loud. Written after moving a Loki install twice and debugging an object store that corrupted everything it was given. https://1shubham7.blog/marp/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/marp/ What Marp is, where it came from, how Marpit turns a Markdown file into a deck, rendering to PDF and PPTX with the CLI, and how to keep a theme shared across every deck instead of copy-pasting CSS. https://1shubham7.blog/daemonsets-rollouts/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/daemonsets-rollouts/ A breakdown of why DaemonSets using hostPort can get stuck in Pending during rolling updates, and why the default maxSurge/maxUnavailable settings aren't always right for them. https://1shubham7.blog/mcp-servers/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/mcp-servers/ A breakdown of the Model Context Protocol - the problem it solves, its architecture, and how a tool call actually works under the hood. https://1shubham7.blog/pdb/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/pdb/ What a PodDisruptionBudget actually does, the difference between voluntary and involuntary disruptions, how the eviction API respects it, and the mistakes that quietly break node drains and cluster upgrades. https://1shubham7.blog/audit-logging/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/audit-logging/ A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters. https://1shubham7.blog/ciso-assisstant/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/ciso-assisstant/ Deploying CISO Assistant via Helm, creating your first superuser, adding users, and how evidence storage actually works. https://1shubham7.blog/gnome-extension/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/gnome-extension/ A few GNOME extensions that genuinely improved my Ubuntu desktop experience, from useful clipboard history to ridiculous window-burning animations. https://1shubham7.blog/redis-backup-restore/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/redis-backup-restore/ How to backup and restore Redis on Kubernetes using RDB snapshots - and why just copying dump.rdb is not enough. https://1shubham7.blog/pv-shift/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/pv-shift/ Why your pod is stuck in Pending, why it lands on the wrong node, and how WaitForFirstConsumer fixes local storage scheduling for good. https://1shubham7.blog/cernbox-federation-kubernetes/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/cernbox-federation-kubernetes/ Running CERN's file sync-and-share middleware on Kubernetes with OCM federation https://1shubham7.blog/grafana-dashboards/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/grafana-dashboards/ Two Grafana dashboards, same node, same timestamp - one shows 62 GB used, other shows 10 GB. Both are correct. Here's the full story of how Linux memory actually works and which number you should actually be watching. https://1shubham7.blog/air-gapped-oncal/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/air-gapped-oncal/ A step-by-step guide to running Grafana OnCall without any egress to grafana.com — using OCI artifacts, init containers, and Kubernetes secrets to deliver plugins in restricted environments. https://1shubham7.blog/terminator/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/terminator/ A complete cheat sheet for the Terminator terminal emulator covering all keyboard shortcuts, broadcast mode, layouts, plugins and launch options. https://1shubham7.blog/jwt/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/jwt/ When creating a website's backend, one very important term we get to hear is JWT authentication. JWT authentication is one of the most popular ways of securing APIs. JWT stands for JSON Web Token and it is an open standard that defines a way for transmitting information between parties as a JSON object and that too securely... https://1shubham7.blog/statefulsets/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/statefulsets/ In simplest terms StatefulSets are Kubernetes component that is used specifically for stateful applications. These are workload API object used to manage stateful applications. They manage the deployment and scaling of a set of Pods (Creating more replicas or deleting them), and StatefulSets are also responsible for the ordering and uniqueness of these Pods. StatefulSet was released in the Kubernetes 1.9 release, let see K8s Statefulsets in this article... https://1shubham7.blog/lfx/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/lfx/ Contributing to open source, specially to the Cloud Native Community Foundation (CNCF) has been one of the most effective ways for me to learn programming, understand how large codebases work and work with experienced engineers on large scale projects. It’s been a year for me as a contributor in the CNCF ecosystem and I also have recently completed my LFX (Linux Foundation Mentorship) program as a mentee. As I wrap up my LFX program I want to share my journey in open source - from contributing to CNCF projects to getting into the prestigious LFX (Linux Foundation Mentorship) program and completing it successfully. https://1shubham7.blog/namespaces/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/namespaces/ Namespaces are Kubernetes Objects used to divide a Cluster into smaller organized sub clusters as per different needs. Namespaces enables users to isolate group of resources within a cluster, this is useful when multiple teams are working on a shared cluster and each team is independent of others. In this article, we will discuss how to change or switch namespaces in a Kubernetes cluster, but before that let’s start with the basics. https://1shubham7.blog/k8s-depl-stratigies/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/k8s-depl-stratigies/ Kubernetes, or K8s, is an open-source container orchestration technology used to automate the manual processes of deploying, managing, and scaling applications with the help of containers. Originally developed by engineers at Google, Kubernetes was donated to the CNCF (Cloud Native Computing Foundation) in 2015... https://1shubham7.blog/kyverno-intro/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/kyverno-intro/ Kyverno is a dynamic admission controller that can be used to govern and enforce how a Kubernetes cluster is used. Admission Controllers Let’s first start with admission controllers since Kyverno is an admission controller. In Kubernetes admission controllers are used to intercept requests going to the API servier and one of the two or both the things with them - mutate or/and validate. Kubernetes comes up with built-in admission controllers. The issue with these built-in admission controllers is that they are highly specific and different organizations may have different use cases with admission contollers not being fulfilled by these built-in admission controllers, therefore, for meeting these requirements we have dynamic admission controllers that can be developed as extensions and can be run as webhooks configured at runtime. https://1shubham7.blog/testing/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/testing/ A beginners guide to writing unit tests in Golang · Let's first start with what unit testing is. Unit Testing is a way of testing where the behavior of a... https://1shubham7.blog/artifacts/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/artifacts/ Artifacts - from beginner to advanced. · What are artifacts? In the broadest sense, artifacts are objects or items created or modified by humans that... https://1shubham7.blog/api/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/api/ API : from beginner to advanced concepts · During our Web development journey will all get to hear the term - API. Some of us must have used some APIs,... https://1shubham7.blog/yaml/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/yaml/ explaining YAML from basics to advanced · What is YAML? YAML (which stands for 'YAML Ain't Markup Language') is a human-readable data serialization... https://1shubham7.blog/database/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/database/ Databases in the simplest yet most powerful way ever. Keeping in mind placements and development. · Databases: just a digital tool that stores and... https://1shubham7.blog/python_datatypes/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/python_datatypes/ Datatypes in Python in simplest yet most effective way. · Python includes 6 types of built-in datatypes - Numeric datatype Boolean datatype Sequence... https://1shubham7.blog/open-source101/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/open-source101/ The terms you should know before beginning your open-source journey · Contributing to open-source projects as a beginner can be a little overwhelming. We... https://1shubham7.blog/sass/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/sass/ SASS vs SCSS, Differences and similarities. · You must have heard of SCSS or SASS, but do you know the full form of the two tools, how similar these two... https://1shubham7.blog/vagrant/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/vagrant/ Vagrant explained for absolute beginner. · So recently, I was setting up locally an open-source software, so to contribute to it (BTW it is called Zulip,... https://1shubham7.blog/osi/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/osi/ OSI Model - Straight to the point. · OSI (Open Systems Interconnection) model describes seven layers through which computer systems communicate over a... https://1shubham7.blog/npm/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/npm/ JSON Explained · We often come through JSON files during developing web applications. you must have noticed that the JSON files store data in the form of... https://1shubham7.blog/json/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/json/ JSON Explained · We often come through JSON files during developing web applications. you must have noticed that the JSON files store data in the form of... https://1shubham7.blog/pvc-clear/ Mon, 01 Jan 0001 00:00:00 +0000 https://1shubham7.blog/pvc-clear/