October 19, 2026
Kubernetes 1.37 makes webhook concurrency an upgrade test
A practical upgrade check for whether your CRD conversion webhook can handle parallel calls during Kubernetes 1.37 API cache initialization.
Read article
Writing on architecture, delivery pipelines, security and data, and the trade-offs behind them.
Essays and shorter notes.
October 19, 2026
PostgreSQL 19 WAIT makes read-your-writes a contract
I explain when waiting for a PostgreSQL replica beats routing reads to the primary, and how to test the latency, timeout, and fallback behavior.
Read article
October 19, 2026
Validate .NET 11 tracing before changing instrumentation
A practical comparison of ASP.NET Core’s built-in traces and existing application spans helps identify duplication, missing context, and what to keep.
Read article
October 19, 2026
Test Claude Code hooks as behavior contracts
I explain why natural-language hooks need adversarial regression tests and where deterministic controls must enforce policy outside the agent.
Read article
October 19, 2026
Trace agent work without mistaking telemetry for evaluation
I explain how agent traces can help connect requests and diagnose failures, while keeping output quality, data exposure and access control as separate concerns.
Read article
October 19, 2026
Plan GitHub Actions investigations around evidence
I explain how to define the evidence, retention and access an incident investigation needs before relying on GitHub Actions Data Stream.
Read article
October 19, 2026
PostgreSQL 19 parallel autovacuum is a resource-budget decision
I explain how to assess PostgreSQL 19 parallel autovacuum against foreground CPU and I/O demand, and how to test limits and monitoring before enabling it.
Read article
October 19, 2026
A runner-image SBOM is not build provenance
A runner-image SBOM inventories preinstalled software, while build provenance connects an artifact to the workflow, actions, and inputs that produced it.
Read article
October 19, 2026
QuickGrid virtualization is a data contract
QuickGrid virtualization depends on stable ordering, useful filtering, and predictable range queries, not only on rendering fewer rows.
Read article
October 19, 2026
AI review findings need a queue, not a gate
AI review can surface defects faster than a team can resolve them; I argue for managing findings as work with explicit triage and release capacity.
Read article
October 19, 2026
Keep roadmap commitments independent of PostgreSQL 19’s release date
I explain how to evaluate PostgreSQL 19 features without making a delivery plan depend on an unsettled release or feature set.
Read article
October 19, 2026
Treat repository-relative workflow references as a versioning choice
A repository-relative GitHub Actions reference ties a reusable workflow to the caller's version, trading centralized upgrades for co-versioned changes.
Read article
October 13, 2026
Treat GitHub Actions cache reuse as a trust boundary
A cache can expose data to readers or let an untrusted workflow influence a trusted build, so I make cache access part of pipeline security design.
Read article
October 13, 2026
A replication-slot status metric is not proof of replication health
I explain what Azure’s logical replication slot sync status can tell you, what it cannot prove, and which signals I would pair with it.
Read article
October 13, 2026
Kubernetes node swap is a workload policy, not a sizing strategy
I explain when Kubernetes node swap can soften memory pressure, when it can hide a capacity problem, and how to pilot it without mistaking swap for free memory.
Read article
October 13, 2026
PostgreSQL’s concurrent REPACK moves the maintenance risk
PostgreSQL 19’s concurrent REPACK can reduce reliance on maintenance windows, but it shifts the risks to write load, storage, replicas and recovery.
Read article
October 13, 2026
CI egress policy should follow workflow trust
Runner identity is not enough to decide what a CI job may contact; I explain how to map dependencies and separate policy by job purpose.
Read article
October 13, 2026
Audit who owns your Kubernetes service IPs
An ownership-first audit of Services using externalIPs helps you choose a safe migration path before Kubernetes removes that behavior.
Read article
October 13, 2026
Deeper workflow nesting needs a legible call graph
Deeper reusable workflows make shared CI/CD more flexible, but clear ownership, inputs, permissions, and deployment paths are what keep changes reviewable.
Read article
October 13, 2026
Treat Helm 4 adoption as a deployment-toolchain migration
A Helm major-version upgrade can leave charts unchanged while changing assumptions in clients, plugins, pipelines, and cluster interactions.
Read article