THE CLOUDGUYS ENGINEERING DESK
Practical guides, architecture decisions, and honest cost breakdowns from the world of cloud engineering.
Compare Headlamp, Freelens, Lens, k9s, Portainer and Berth on the questions that decide the choice: how you sign in, what each can change, what its AI sends where, what it costs, and whether it is maintained.
Read the insight ↗The official Kubernetes Dashboard is archived and its Helm repository URL now returns 404. What changed, what the project recommends, and how Headlamp, Freelens, Lens, k9s, Portainer and Berth compare, with sources and dates.
Read the insight ↗How to replace the archived Kubernetes Dashboard without losing access or leaving cluster-admin bindings behind: inventory, install Headlamp or Berth beside it, verify, remove, and clean up.
Read the insight ↗On one traced question, an analyst agent took 43.5 seconds, ran three queries and consumed 137,040 tokens. Four causes, one prompt-caching trap, and a wrong number hiding in the same trace.
Read the insight ↗About 90% of the rows in four supplier channel tables already existed in the master reservation table. A plain UNION ALL would have counted them twice and the key test would have passed. The dedup union, the count that checked it, and the test that catches it.
Read the insight ↗A fact-checked 2026 guide to EKS node autoscaling: how Karpenter, Cluster Autoscaler, and EKS Auto Mode differ, what fees apply, and how to protect latency during consolidation.
Read the insight ↗Every query our analyst agent runs is written by a language model. Six layers stand between that text and the warehouse, but only one of them is the guarantee. Four hostile queries, the layer that stops each, and what the guard still does not stop.
Read the insight ↗We measured how a small model used our agent's tools, found three that overlapped, merged them without changing the security boundary, and measured again. A smaller prompt, no change in pass rate, and a problem the merge did not touch.
Read the insight ↗Three rounds of scoring problems in an agent evaluation: regexes too narrow, a credential check that fired on a redacted password, and the three lines we drew for changing criteria after reading answers.
Read the insight ↗How dbt persist_docs turns YAML descriptions into Postgres COMMENTs and then into an AI analyst's data dictionary, the stale mart description that told the agent its USD columns did not exist, and the deploy chain that decides when a fix reaches it.
Read the insight ↗The harness behind Berth's AI SRE evals: a fixture cluster, the product's real prompt and tools, deterministic scoring, stub models that prove the scorer, and what none of it can tell you.
Read the insight ↗We ran four local-model setups through 9 scripted Kubernetes failures, 3 runs each, on one Apple M4 Pro: speed, pass rate, safety under injection, and what thinking mode costs. Our own tuned model did not beat the stock one.
Read the insight ↗Real failures from repeated runs of a local model on scripted Kubernetes incidents: skipped evidence, a misread unit, backwards capacity reasoning, shallow discovery, over-exploration, and omissions that every model made.
Read the insight ↗We planted instructions in a Kubernetes event, a pod name and a log line, and watched local models. Some advised deleting a namespace. Here is what that did and did not risk, and why the defence is structural.
Read the insight ↗An agent loop with a tool-call cap can end without an answer. How we found it in a local-model agent and a cloud one, what we changed (a forced final answer, an explicit instruction, one retry), and how much it did and did not prove.
Read the insight ↗Berth's AI SRE eval data is public: 17 synthetic Kubernetes scenarios, repeated local-model runs, the criteria we changed and why, and a claims ledger. The harness stays private; here is what that means.
Read the insight ↗How Berth 0.5.0 (restricted beta) fixes agents that run out of tool calls without answering, why overlapping tools made small models dither, how the merged tools route, and what the before and after runs showed.
Read the insight ↗How nomus runs a million-parameter recurrent network on the browser's audio thread: a Rust engine compiled to a WebAssembly module with no imports, a flat C ABI, and a worklet that never throws.
Read the insight ↗The metrics, test sets and selection rules behind nomus's voice-preserving music filter, the runs that collapsed, the competitor benchmark we lost on one axis, and the cases where the shipping model still fails.
Read the insight ↗How nomus runs one real-time audio engine in a Chrome extension, an Android app and desktop apps for macOS and Linux, and what each platform demanded that the engine could not provide.
Read the insight ↗Berth is a self-hosted Kubernetes dashboard that runs in your own cluster. Observe health and capacity, expose apps end to end, and ask a read-only AI SRE what is happening now.
Read the insight ↗A safe, end-to-end guide to installing the Berth Kubernetes dashboard with Helm: token auth, loopback access, Ingress, TLS, and license keys.
Read the insight ↗How Berth's read-only AI SRE for Kubernetes stays grounded on live cluster evidence, proposes fixes you review, and can change nothing on its own.
Read the insight ↗Plan a PostgreSQL migration with clear write ownership, measurable cutover gates, data validation, and a rollback strategy that accounts for new writes.
Read the insight ↗Istio service mesh is great for many things ie. Security, Multicluster and hybrid deployment, Circuit breaking, rate limiting, retries, service-to-service authentication/authorization, cluster-wide mTLS, and many more. But this demo will focus on the Canary deployment with Kubernetes Gateway API and Istio.
Read the insight ↗Istio ambient mesh is great for many things ie. sidecar-free mTLS, L4 authorization with ztunnel, a clean Gateway API entry point, and a much smaller per-pod footprint than the old sidecar model. But the moment you put a service behind an ambient ingress gateway, one thing quietly breaks: access logs stop showing who is actually calling the service. And the way it breaks is nastier than the usual “read X-Forwarded-For” story, because it breaks intermittently.
Read the insight ↗Short answer: Hiring one in-house DevOps engineer costs roughly $150,000–$200,000/year fully loaded — and a single person cannot provide 24/7 coverage, take vacation, or cover every domain (Kubernetes, networking, security, cost, databases). Managed DevOps typically runs $500–$2,500/month for equivalent or broader coverage, with no recruiting cycle and no key-person risk. The right choice depends on how much ongoing, original infrastructure engineering you actually have — not on day-to-day operations.
Read the insight ↗Managed PaaS (Heroku, Render, Vercel) is the cheapest option when your bill is small and your team is tiny. It becomes the most expensive option once you cross roughly $2,000/month in platform spend, because you're paying a 3–10x markup on raw compute for convenience you eventually outgrow. The best alternatives in 2026 are AWS ECS/Fargate or Cloud Run (the moderate step) and managed Kubernetes — EKS, GKE, AKS (the full step), ideally run for you so you don't trade a platform bill for a hiring problem.
Read the insight ↗Maximize Cloudflare’s Free tier for WordPress using OpenTofu/Terraform. Learn how to provision 77+ resources, including WAF rules, Cache Rules, and security headers, via Infrastructure as Code - without spending a dime.
Read the insight ↗Ship fast without breaking prod. Our 5 guardrails: change windows, policy-as-code, canary releases, SLO-based gating, and automated rollback.
Read the insight ↗From the three-repository pattern to progressive delivery with Argo Rollouts. Real-world GitOps architecture that eliminates drift and provides audit trails.
Read the insight ↗Stop clicking in the console. Learn the 5 non-negotiable best practices for scaling your Infrastructure as Code using Terraform.
Read the insight ↗Combine Terraform and Ansible to fully automate AWS Bastion Host deployment. This project provisions EC2 infrastructure and configures it with Docker/Compose v2 in one single, repeatable IaC workflow.
Read the insight ↗Why committing .tfstate to Git is a security disaster. A guide to setting up robust S3+DynamoDB remote backends with encryption and locking.
Read the insight ↗
