DevOps Daily with Fexingo: CI/CD, Kubernetes, and Modern Software Operations

Lucas and Luna dig into a specific Kubernetes failure pattern that most teams discover the hard way: network policies that block healthy traffic after a rollout. They walk through a real incident at a mid-size fintech company where a seemingly innocuous deny-all ingress policy took down payment processing for 47 minutes. Lucas explains how Kubernetes NetworkPolicy objects are evaluated, why defaul...

In this episode of DevOps Daily, Lucas and Luna tackle a subtle but costly problem in Kubernetes configuration management: Kustomize overlays that silently diverge from their base configurations. Using a real-world example from a mid-size e-commerce company, they break down how three overlays intended to customize deployments for dev, staging, and production environments ended up creating a cascad...

In episode 52 of DevOps Daily with Fexingo, Lucas and Luna dig into a hidden performance gotcha in Kubernetes service discovery: the EndpointSlice controller's default sync interval. Lucas walks through a real incident at a mid-size e-commerce company where a deployment rollout caused five minutes of traffic blackholing because EndpointSlices lagged behind pod readiness. They compare EndpointSlice...

In this episode of DevOps Daily, Lucas and Luna explore a hidden cost of Kubernetes service meshes: the memory overhead of sidecar proxies. They break down how Istio's Envoy sidecars commonly consume 50-100 MB per pod, and how a 50-node cluster with 200 pods can waste over 10 GB of RAM just on proxy overhead. They compare sidecar-less alternatives like Cilium's eBPF-based mesh and Istio's ambient...

Episode 50 of DevOps Daily with Fexingo takes a hard look at Kubernetes PriorityClasses — the feature meant to ensure critical pods run first but often backfires into scheduling chaos. Lucas and Luna unpack a real production outage at a mid-sized fintech company where misconfigured priority classes caused a cascade of evictions and resource starvation. They walk through the mechanics of preemption...

In this episode of DevOps Daily with Fexingo, Lucas and Luna dive into a specific failure mode that often surprises even experienced Kubernetes operators: cascading failures caused by mishandled node draining. They walk through a real-world scenario where a routine node drain for a kernel patch triggered a chain reaction: PodDisruptionBudgets were respected on paper, but the remaining nodes couldn...

In this episode, Lucas and Luna dive into a deceptively tricky Kubernetes feature: CronJob timezone handling. They break down how CronJobs default to UTC regardless of the cluster's regional settings, leading to off-schedule jobs, missed backups, and batch processing failures. Using a real-world example from a fintech company that lost two hours of payment reconciliation data, they explain why the...

Lucas and Luna revisit pod security standards in Kubernetes, digging into a specific case where a restricted PSP still allowed privilege escalation through a misconfigured seccomp profile. They walk through a real-world example from a fintech startup that ran a compliance audit and discovered their 'secure' pods were running with default-deny seccomp disabled. The conversation covers why PSPs and...

Lucas and Luna break down a subtle but costly Kubernetes anti-pattern: using pod priority and preemption without proper resource accounting. They walk through how a mid-stage startup accidentally triggered a cascading preemption storm by misconfiguring priority classes on their CI/CD runners and ML training pods, leading to 40% wasted compute and unpredictable evictions. Lucas explains the math be...

Episode 45 of DevOps Daily with Fexingo digs into Kubernetes topology spread constraints – the feature meant to spread pods evenly across failure domains, but that can actually create severe node imbalances. Lucas and Luna explore a real incident where a three-node cluster ended up with 40 pods on one node and 4 each on the others, causing resource exhaustion and cascading failures. They explain h...

Lucas and Luna dive into a hidden cost driver in Kubernetes clusters: node priority and the scheduler's 'most requested' scoring. They explain how default scheduling behavior over-provisions nodes, why even well-tuned clusters run 15-30% extra capacity, and a concrete fix using pod priority classes and node affinity. The episode walks through a real-world case where a mid-size fintech reduced its...

Episode 43 of DevOps Daily with Fexingo dives into a hidden failure mode of the Kubernetes Cluster Autoscaler: it frequently fails to scale up new nodes quickly enough after a spot instance interruption. Lucas explains how the default unready-node-taint strategy can delay scale-up by several minutes, causing pods to stay pending and potentially triggering cascading failures. He walks through a rea...

Episode 42 of DevOps Daily with Fexingo digs into a concrete problem with Kubernetes Horizontal Pod Autoscaler (HPA): it reacts to past metrics, not future demand. Lucas and Luna walk through a real-world scenario where a flash sale at an e-commerce company caused a five-minute latency spike before HPA caught up. They explain how the default two-minute cooldown window, aggregation intervals, and m...

Episode 41 of DevOps Daily with Fexingo dives into the overlooked security risks of Kubernetes Ingress controllers. Lucas and Luna break down a real-world case where a misconfigured NGINX Ingress exposed internal APIs to the internet, leading to a data breach. They explain how default rules, lack of request validation, and forgotten annotation changes can turn a routing layer into an attack vector...

In this episode of DevOps Daily with Fexingo, Lucas and Luna dive into a commonly overlooked vulnerability in Kubernetes clusters: ConfigMaps. While ConfigMaps are widely used to decouple configuration from container images, they often end up storing sensitive data like database passwords, API keys, and service tokens in plain text. This practice creates a security liability that can be exposed th...

In this episode of DevOps Daily, Lucas and Luna tackle a persistent security blind spot in Kubernetes: Pod Security Standards (PSS) and why they still leak sensitive data. They walk through a real-world case where a team using PSS with the 'baseline' profile left a sidecar container unmonitored, exposing database credentials. Lucas breaks down how PSS policies only check admission time, not runtim...

In this episode of DevOps Daily with Fexingo, Lucas and Luna dig into a costly Kubernetes misconfiguration that flies under the radar: the PersistentVolume reclaim policy. Most teams set it to 'Delete' and forget it, but that means every time a PersistentVolumeClaim is deleted, the underlying volume (like an EBS or GCE PD) gets wiped out too—along with any data. Lucas walks through a real example:...

In this episode of DevOps Daily with Fexingo, Lucas and Luna dig into a subtle but dangerous gap in Kubernetes Pod Security Standards (PSS) — the admission controller that replaced PSPs. They walk through a real-world example: a team running a sidecar container with a privileged profile, bypassing the baseline policy because PSS applies to pods but not to init containers and ephemeral containers a...

This episode of DevOps Daily with Fexingo dives into a common but overlooked security gap: how Kubernetes image pull secrets can be accidentally exposed through base image inheritance and registry mirror configurations. Lucas walks through a real-world case where a team at a mid-sized fintech left their private registry credentials embedded in a public Docker layer, allowing anyone who pulled the...

Lucas and Luna dig into a specific problem that catches many DevOps teams off guard: how Kubernetes clusters quietly inflate cloud bills through shared resource allocation. They examine a real example from a mid-sized fintech startup that saw its monthly AWS spend jump 40 percent after moving to a multi-tenant cluster without proper cost tagging. Lucas explains the difference between resource requ...

In this episode of DevOps Daily, Lucas and Luna dig into a persistent Kubernetes pitfall: mismatched resource requests and limits. Using a real-world example from a mid-sized fintech company that saw 40% higher cloud bills and intermittent OOM kills, they explain why setting CPU and memory requests too high or too low creates a double penalty — wasteful reservation and unpredictable performance. T...

In this episode of DevOps Daily with Fexingo, Lucas and Luna explore a common but overlooked security risk in Kubernetes: overly permissive Role-Based Access Control (RBAC) configurations. They start with a real-world example from a mid-size fintech that suffered a breach because a service account had cluster-admin privileges. They break down why default roles like 'cluster-admin' and 'edit' are o...

Episode 32 of DevOps Daily with Fexingo. Lucas and Luna dive into the hidden gap between Kubernetes audit logs and actual attacker behavior. Using the real-world example of the 2024 Latacora breach — where a stolen kubeconfig allowed lateral movement for 47 minutes before any log entry fired — they explain why most audit policies are tuned to the wrong signals. Lucas breaks down the difference bet...

Lucas and Luna dive into a silent threat in Kubernetes security: network policies that are incomplete, misconfigured, or poorly maintained. They walk through a real incident where a supposedly secure cluster had a default-deny policy that was accidentally bypassed by an allow-all rule on a single namespace, exposing a database to the internet. They explain why network policies give a false sense o...

Episode 30 of DevOps Daily with Fexingo: Lucas and Luna dig into why standard Kubernetes liveness and readiness probes often give teams a false sense of security. They walk through a real-world case where a service passed health checks but crashed under load because probes only tested a single endpoint. They break down the difference between basic TCP probes, HTTP probes, and deep dependency-aware...