https://jesusoseguera.dev/tags/kubernetes/Recent content in Kubernetes on Jesus OsegueraHugoen-usWed, 01 Jul 2026 00:00:00 +0000https://jesusoseguera.dev/projects/eks-gitops/Wed, 01 Jul 2026 00:00:00 +0000https://jesusoseguera.dev/projects/eks-gitops/Overview Built a CI/CD security pipeline for AWS EKS with no long-lived cloud credentials in the system. GitHub Actions authenticates to AWS through OIDC/IRSA, every deployment is gated behind a 10-stage DevSecOps pipeline, and runtime detection is covered with Falco plus timed drills whose results feed a shared metrics schema in CI. Technologies: Terraform, AWS EKS, ArgoCD, GitHub Actions, Cosign/Sigstore, OPA Gatekeeper, Falco, Argo Rollouts, Prometheus, Grafana Features Zero long-lived AWS credentials in CI: GitHub Actions to AWS via OIDC, ArgoCD to the cluster via IRSA 10-stage pipeline: secret scanning, SAST, SCA, IaC scanning, and container CVE scanning before promote Keyless image signing with Cosign/Sigstore and SBOMs attached as attestations Progressive canary delivery with Argo Rollouts, promoted or rolled back from Prometheus success-rate and latency metrics OPA Gatekeeper admission policy cluster-wide Falco 0.https://jesusoseguera.dev/projects/aks-pipeline/Mon, 01 Jun 2026 00:00:00 +0000https://jesusoseguera.dev/projects/aks-pipeline/Overview Delivered a second DevSecOps platform on Azure AKS at roughly half the monthly infrastructure cost of the equivalent AWS EKS project (~$80/mo vs. ~$165/mo). Both platforms isolate dev and prod as namespaces on one cluster; the cost gap comes from AWS charging for the EKS control plane and a NAT Gateway, where AKS’s control plane is free. Runtime coverage uses Microsoft Defender for Containers with a documented drill path into the same metrics schema used on AWS and the homelab.https://jesusoseguera.dev/projects/platform-engineering-homelab/Fri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/platform-engineering-homelab/Overview Reprovisioned a 10-VM Proxmox environment into a self-managed, highly available Kubernetes platform (3 control-plane + 3 worker nodes), driven from a single git clone through a GitLab CI pipeline. This is the layer managed Kubernetes hides: hypervisor, VM lifecycle, networking, and kubeadm bootstrap, with admission and runtime controls that cannot inherit a cloud provider baseline. Technologies: Terraform, Ansible, Proxmox VE, Kubernetes (kubeadm), ArgoCD, Cilium, HashiCorp Vault, Harbor, OPA Gatekeeper, Falco, Longhorn, kube-prometheus-stack, Loki, GitLab CI