Chasing headroom for one more node under a fixed budget: reading the Azure bill precisely, a disk-billing surprise that reverses an earlier decision, bounding the k3s control-plane heap with GOMEMLIMIT, and why reserved instances were a dead end on this subscription.
Moving metrics off the cluster to a managed backend while keeping a light collector, validating a rewritten scrape config without touching production, and right-sizing the pieces that were quietly wasting resources: CPU throttling on idle pods and an unbounded controller heap.
Self-hosting the metrics pipeline on a small cluster: why VictoriaMetrics over Prometheus, adapting scraping to k3s where the control plane is a single process, cutting ingest by ninety percent, and a memory incident that took the whole GitOps loop down with it.
The finale: a disaster-recovery model where only one key is precious, an 8-step rebuild runbook verified twice, a cross-region migration, how to actually read the Azure bill, and trimming cost by swapping disk tiers.
The reusable patterns that make new apps a copy-paste: a stateless static-site template, the shared-Postgres pattern, Headlamp delegating RBAC to the API server, keeping a password manager stateless with a sealed RSA key, and Miniflux OIDC plus an Azure Postgres extension gotcha.
One login for every app: a lightweight LDAP directory (LLDAP) plus Authelia doing both forward-auth and OIDC, global default-protect with a bypass list, provisioning 2FA without email, and the three authentication patterns you end up mixing.
Why I keep state out of the cluster: the storage landscape for Kubernetes, what local-path really costs you, one shared managed Postgres with a database per app, why no Redis, and a three-way storage strategy.
How to put encrypted secrets directly in Git with SealedSecrets: how the asymmetric sealing works, sealing and handing off a secret, and the one key you must back up offline or lose everything.
One wildcard certificate for every subdomain via cert-manager and ACME DNS-01, writing a custom webhook solver when your DNS provider has none, serving it everywhere with a Traefik default TLSStore, and making Traefik itself highly available.
Installing Argo CD, connecting a private repo, the App-of-Apps bootstrap, Kustomize base plus overlay, CI that builds images and bumps tags, private image pulls, and having Argo CD manage its own installation.