DevOps Daily with Fexingo: CI/CD, Kubernetes, and Modern Software Operations

Lucas and Luna dive into the hidden performance cost of running a service mesh in Kubernetes. Using Istio and Linkerd as examples, they unpack how sidecar proxies add 2-5 milliseconds of latency per hop, and how mesh overhead compounds in deep call chains. They walk through a real-world scenario where a 12-microservice transaction saw tail latency spike from 50ms to 210ms after enabling mutual TLS...

Episode 28 of DevOps Daily with Fexingo dives deep into a common but often overlooked performance pitfall: Kubernetes Persistent Volume Claims (PVCs). Lucas and Luna unpack a real-world case where a fintech company's database workloads suffered 40% latency spikes due to misconfigured PVC storage classes and access modes. They explain how volume binding modes, reclaim policies, and CSI driver setti...

Episode 27 of DevOps Daily with Fexingo: Lucas and Luna dive into a silent performance killer in Kubernetes clusters—how Persistent Volume Claims with default storage classes can cause latency spikes and throughput bottlenecks. Using a real-world case from a fintech startup running Cassandra on AWS EBS gp2 volumes, Lucas explains why their 99th percentile read latency jumped from 5ms to 120ms unde...

Episode 26 of DevOps Daily with Fexingo. Lucas and Luna dive into why Kubernetes rollbacks are riskier than most teams realize. They examine a case where a simple image tag rollback silently reverted a critical security fix, breaking compliance for days. They discuss why declarative state doesn't protect you from bad rollouts, how Helm and Argo CD handle (or fail to handle) rollback semantics, and...

Episode 25 of DevOps Daily with Fexingo dives into a specific Kubernetes failure mode: Pod Disruption Budgets (PDBs) that prevent node drains during planned maintenance. Lucas and Luna break down a real incident where a cluster's PDBs blocked critical node updates, causing a multi-hour outage. They explain how PDBs work, why common configurations like minAvailable: 100% can lock you into a deadloc...

Episode 24 of DevOps Daily with Fexingo digs into a subtle but painful Kubernetes performance trap: the relationship between pod resource limits (CPU throttling) and application latency. Lucas and Luna examine a real-world case from a fintech company where setting CPU limits too low caused tail-latency spikes during normal traffic. They explain the difference between compressible and incompressibl...

Lucas and Luna dive into Kubernetes pod priority classes and preemption—a feature designed to ensure critical pods get resources, but one that can cause cascading failures and starvation for lower-priority workloads. They walk through a real scenario at a mid-size fintech that saw critical database pods preempting batch jobs, only to have those batch jobs reschedule and overwhelm the cluster. Luca...

In this episode of DevOps Daily, Lucas and Luna break down why graceful shutdown is failing in Kubernetes clusters. They examine the lifecycle of a pod being terminated, explaining the sequence of SIGTERM, terminationGracePeriodSeconds, and preStop hooks. Using a real-world example of a Node.js web service that was dropping thousands of in-flight requests during rollouts, they reveal the hidden de...

A 45-second container shutdown sounds harmless until it costs you a production database connection pool. Lucas and Luna explore why most Kubernetes pods ignore SIGTERM, how a missing preStop hook turned a routine deployment into a 15-minute outage for a European payments platform, and the three-line fix that cuts pod termination from 30 seconds to under one second. They drill into the mechanics of...

In this episode, Lucas and Luna dig into the mechanics of Kubernetes Horizontal Pod Autoscaler — specifically why it often fails to keep up with sudden traffic spikes. They walk through a real-world scenario from a retail platform that saw request latency spike from under 100ms to over 2 seconds during a flash sale. The root cause wasn't resource limits or cluster size — it was the default HPA sca...

Lucas and Luna dive into why rate limiting at the Kubernetes ingress layer is a critical, often overlooked practice for modern DevOps teams. They break down a real-world scenario: a startup whose API gateway collapsed under a traffic spike from a single misconfigured client, causing a cascading outage across microservices. Lucas explains the difference between application-level and ingress-level r...

In this episode of DevOps Daily, Lucas and Luna dig into a quietly catastrophic antipattern: stuffing multiple containers into a single Kubernetes pod. They break down a real-world case where a monitoring stack with five containers per pod caused a production meltdown—crashing the main application container because a sidecar container leaked memory. They explain why the pod is not a lightweight VM...

Lucas and Luna dive into the anti-pattern of stuffing multiple containers into a single Kubernetes pod. They trace the problem to early Docker Compose habits, explain why sidecar containers for logging and metrics are often the wrong choice, and walk through a real-world example where a team at a fintech startup saw pod startup times jump from 8 seconds to 47 seconds after adding a third container...

In this episode of DevOps Daily, Lucas and Luna dig into Kubernetes audit logs — the overlooked data source that can save your organization from a compliance disaster. They walk through a real case of a fintech startup that caught an insider data exfiltration attempt only because they had enabled audit logging on their clusters. Lucas explains the three tiers of audit policies (Metadata, Request,...

In this episode of DevOps Daily with Fexingo, Lucas and Luna dive into a critical but often overlooked failure point in container workflows: the moment an image hits your private registry. They unpack why scanners alone aren't enough, how a single unvetted pull can cascade into a cluster-wide CVE, and the concrete architecture change — a pre-pull vulnerability scan gate — that can catch supply-cha...

In this episode, Lucas and Luna dive into Kubernetes Pod Security Admission — the successor to PodSecurityPolicies (PSPs) that's now mandatory in Kubernetes 1.25 and later. They break down the three built-in security levels (privileged, baseline, restricted), walk through a real-world migration from PSPs to PSA for a fintech company, and explain why most teams have misconfigured their admission we...

Lucas and Luna drill into a specific, overlooked compliance risk in modern software operations: unpatched base images in Docker registries. They walk through a real scenario from a fintech startup that failed a SOC 2 audit because a six-month-old Node.js base image contained known vulnerabilities. The hosts explain why most image scanning pipelines miss what matters, how distroless images change t...

Episode 12 of DevOps Daily digs into Kubernetes RBAC misconfigurations — the single biggest compliance blind spot in most cloud-native environments. Lucas and Luna walk through a real incident at a mid-sized fintech where a single over-permissive ClusterRole let an attacker pivot to production data. They break down the principle of least privilege, how to audit your existing RBAC bindings with ope...

Lucas and Luna dive into the most critical and overlooked artifact in modern infrastructure: the Terraform state file. They explain why losing or corrupting state.json means losing control of your entire cloud estate. Using the real-world example of a 2024 incident where a major SaaS provider accidentally deleted its production state file during a migration, they walk through the anatomy of the fa...

Episode 10 of DevOps Daily. Lucas and Luna dig into a problem every engineering team is facing in mid-2026: cloud CI costs spiralling out of control. They walk through a real example of a mid-stage startup whose GitHub Actions bill hit $14,000 in a single month because of one misconfigured matrix build. They discuss why cost caps are the missing control plane, how tools like Buildkite and self-hos...

Lucas and Luna dive into Kubernetes network policies — a critical but often overlooked security layer. They explain why default 'allow all' traffic is risky, how a single misconfigured policy can expose your cluster, and walk through a real-world example from a fintech startup that locked down its microservices. Listeners will learn the three essential network policy rules every DevOps team should...

Lucas and Luna dive into why Kubernetes Pod Security Policies are being deprecated and what Pod Security Admission replaces them with. They break down the practical impact on DevOps teams, how to migrate without breaking production, and why the old approach created more work than security. If you're still using PSPs or have avoided updating, this episode gives you the migration playbook. #Kubernet...

In this episode of DevOps Daily, Lucas and Luna dig into a surprisingly common blind spot in Kubernetes deployments: misconfigured Helm charts that leak secrets, expose ports, or grant overly broad RBAC permissions. They walk through a real incident from a fintech startup that lost $12,000 in crypto mining costs because a Helm chart default exposed their cluster's metadata API. Lucas explains why...

Episode 6 of DevOps Daily with Fexingo tackles a common but dangerous assumption in modern CI/CD: that security scanning should happen after tests pass. Lucas and Luna walk through a real September 2025 incident at a fintech startup where a leaked AWS key in a public repo wasn't caught until 47 minutes after merge. They explain why shifting secret scanning to pre-commit hooks and pre-CI gates — wi...

Lucas and Luna dive into infrastructure-as-code linting—why most DevOps teams skip it and why that's a costly mistake. Lucas walks through a specific case: how HashiCorp's Sentinel policy-as-code framework caught a misconfigured Terraform module that would have exposed an entire production database. They discuss static analysis tools like Checkov and tfsec, the difference between linting and polic...