In the fifth and final part of this blog series, I share my observations in the cloud resource brokering space (deploying Cloud resources from Kubernetes. Previous parts: Part 1 — Overview, K8s PaaS offerings, Networking Part 2 — Workload Identity, Secret Management / Externalization Part 3 — GitOps Part 4…

In the fourth part of this blog series, I share my observations in the policy enforcement space. Previous parts: Part 1 — Overview, K8s PaaS offerings, Networking Part 2 — Workload Identity, Secret Management / Externalization Part 3 — GitOps Policy Enforcement Policy enforcement and controls management is a key area in…

In the third part of this blog series, I share my observations regarding the use of GitOps to manage platform components and workloads running on kubernetes. Previous parts: Part 1 — Overview, K8s PaaS offerings, Networking Part 2 — Workload Identity, Secret Management / Externalization GitOps Tooling The market has no lack…

Lately, I’ve picked up a side project that I’ve been meaning to do for a long time, replace an application I wrote in Perl to Golang (yeah I know…Perl!). As my codebase grew, my usage of 3rd party libraries did likewise. At first, I would use VSCode and check for…

In the second part of this blog series, share my observations regarding the use of workload identities and how to manage secrets based on my experience across 3 Kubernetes platforms for our clients. Workload Identity Kubernetes uses Service Accounts to represent workloads. These accounts are only visible within the scope of a…

Last week, I completed another consulting engagement in the Financial Services / Banking industry here in Canada. This wrapped up my 3rd platform build with Kubernetes as the foundation. The platforms can be summarized as: Over the weekend, I was reflecting on the platforms and started to think about how…

In a recent blog, I covered how global MeshConfig settings can be configured in Anthos Service Mesh. Now it is time to talk about the story that led me there! We currently run a multi-cluster environment and recently enabled service discovery by adding the Istio remote secrets to the clusters…

Recently, as I worked through an issue with Service Discovery in a multi-cluster setup with a Google managed control plane, I needed to configure Mesh-wide settings. I won’t get into the actual story, that’s a topic for another blog, as I want to focus on the configuration step When looking…

Developing OPA policies requires a combination of Rego language and YAML configuration. To validate that the policy is valid, there are a few approaches: Unit Testing — Validate individual set of assertions with unit tests. Rego, like most language has a unit testing framework. Based on the complexity of the…