Notes on DevOps, platform engineering, Kubernetes and sovereign cloud infrastructure.https://romancenko.com/https://romancenko.com/blog/uptime-monitoring-as-code-site24x7/https://romancenko.com/blog/uptime-monitoring-as-code-site24x7/An external uptime check, defined in Terraform, on a free plan. It took a data-center mix-up, a trial-versus-free-plan question nobody documents, and a provider whose defaults pointed at Asia Pacific. The journey, the Terraform, and the Zoho OAuth flow underneath it.Mon, 21 Sep 2026 00:00:00 GMTInfrastructure as CodeTerraformSite24x7OAuthMonitoringhttps://romancenko.com/blog/monitoring-alerting-logging-on-a-budget/https://romancenko.com/blog/monitoring-alerting-logging-on-a-budget/Part three of the CI/CD series: once the pipeline could be trusted to ship, the next question was whether the site itself could be trusted to say so. Golden signals on a static site, why two alarms had to live in us-east-1, an uptime check from outside AWS, and why every log here expires in three days.Sun, 20 Sep 2026 00:00:00 GMTPlatform EngineeringMonitoringCloudWatchAWSObservabilityhttps://romancenko.com/blog/building-the-free-gitlab-pipeline/https://romancenko.com/blog/building-the-free-gitlab-pipeline/The follow-up to the CI/CD decision post, covering what actually got built: why GitLab won, how the pipeline is wired, what it costs, and the security choices that turned out to matter more than the vendor pick.Sat, 19 Sep 2026 00:00:00 GMTCI/CDCI/CDGitLabAWSIAMhttps://romancenko.com/blog/cheap-cicd-what-free-actually-means/https://romancenko.com/blog/cheap-cicd-what-free-actually-means/A side project with a genuine $0 budget forces a question most teams never ask: does this pipeline need a server at all? Real free-tier numbers, one real OIDC failure, and the one question that actually predicts the bill.Fri, 18 Sep 2026 00:00:00 GMTCI/CDCI/CDAWSGitHub ActionsServerlesshttps://romancenko.com/blog/networkpolicy-drop-three-bugs/https://romancenko.com/blog/networkpolicy-drop-three-bugs/A missing egress port, a flawed debug test, and a live patch that kept silently reverting: how one dropped Kafka connection sent an investigation down three wrong paths first.Wed, 16 Sep 2026 00:00:00 GMTKubernetesKubernetesNetworkingIncident Responsehttps://romancenko.com/blog/zero-downtime-kubernetes-deploys/https://romancenko.com/blog/zero-downtime-kubernetes-deploys/Rolling updates, readiness probes, PodDisruptionBudgets and the CI/CD gates that turn 'it should be fine' into a guarantee.Wed, 12 Aug 2026 00:00:00 GMTKubernetesKubernetesCI/CDReliabilityhttps://romancenko.com/blog/sovereign-cloud-platform-governance/https://romancenko.com/blog/sovereign-cloud-platform-governance/Notes from building an operational delivery function for a regulated, national-infrastructure cloud platform, where governance has to be an enabler, not a gate.Wed, 01 Jul 2026 00:00:00 GMTPlatform EngineeringPlatform EngineeringGovernanceSovereign Cloudhttps://romancenko.com/blog/terraform-at-scale-lessons/https://romancenko.com/blog/terraform-at-scale-lessons/What actually breaks when Terraform grows from a single account to a shared platform: state, modules, and the boring conventions that save you.Wed, 20 May 2026 00:00:00 GMTInfrastructure as CodeTerraformIaCAWSGCPhttps://romancenko.com/blog/no-errors-found-tooling-gotcha/https://romancenko.com/blog/no-errors-found-tooling-gotcha/A short-lived cluster credential expired mid-investigation and quietly turned every log sweep into a false all-clear. The failure mode that should worry you most is the one that looks like success.Wed, 08 Apr 2026 00:00:00 GMTKubernetesKubernetesObservabilityToolinghttps://romancenko.com/blog/leading-a-platform-team/https://romancenko.com/blog/leading-a-platform-team/Eight engineers, one 24/7 production platform, and a constant stream of requests that are rarely just technical. Notes on rotas, upskilling and the parts of the job nobody puts in the job description.Tue, 03 Mar 2026 00:00:00 GMTTeamTeam LeadershipOn-CallPeoplehttps://romancenko.com/blog/backend-healthy-app-still-down/https://romancenko.com/blog/backend-healthy-app-still-down/A message broker's HA failover completed cleanly in three minutes. Client apps kept failing for fifteen more. The gap between those two numbers is where the real bug was hiding.Sat, 14 Feb 2026 00:00:00 GMTCloud FoundryCloud FoundryNetworkingKuberneteshttps://romancenko.com/blog/leader-election-looking-for-sidecar/https://romancenko.com/blog/leader-election-looking-for-sidecar/A Cloud Foundry app kept failing to connect to localhost:80 for something it never should have been talking to localhost about. It had brought a Kubernetes assumption with it that didn't survive the move.Mon, 05 Jan 2026 00:00:00 GMTCloud FoundryCloud FoundryKubernetesPlatform Engineeringhttps://romancenko.com/blog/cluster-wide-outage-single-component/https://romancenko.com/blog/cluster-wide-outage-single-component/A CNI sync component lost both replicas to a run of bad scheduling luck, and for about an hour, no node in the cluster could route Service traffic, including nodes that never stopped reporting healthy.Mon, 24 Nov 2025 00:00:00 GMTKubernetesKubernetesIncident ResponseReliabilityhttps://romancenko.com/blog/two-boring-pipeline-bugs/https://romancenko.com/blog/two-boring-pipeline-bugs/A blank config default that silently meant 'no image pinned,' and a deploy stage for a component that no longer existed. Neither is exciting. Both should have been impossible.Sat, 30 Aug 2025 00:00:00 GMTCI/CDCI/CDPlatform EngineeringAutomationhttps://romancenko.com/blog/pipeline-hang-git-credential-prompt/https://romancenko.com/blog/pipeline-hang-git-credential-prompt/A submodule clone inside a CI task hit a credential prompt no human would ever see, and instead of failing, it just sat there. A hang is a worse failure mode than an error, and it's usually self-inflicted.Tue, 17 Jun 2025 00:00:00 GMTCI/CDCI/CDConcourseGit