Labs

A security audit found no runtime monitoring layer on the cluster beyond network policy, so Falco was deployed to detect anomalous behavior (container exec, sensitive file reads), with custom rules and Falcosidekick integration.

Calico is the current CNI but lacks L7 observability (IP/port only, no HTTP path visibility), so Cilium was evaluated as a replacement with eBPF-based network policies, Hubble observability, and performance benchmarks.

The current OpenVPN site-to-site setup is complex to configure and slow to onboard new peers, so a lighter peer-to-peer WireGuard mesh network was built for remote access to dev infrastructure.

A public server was under continuous SSH brute-force attempts and the existing Fail2ban only blocked single IPs, so CrowdSec was deployed with community threat intel, integrating bouncers on Nginx and SSH.

K3s was being considered for resource-constrained edge sites (Raspberry Pi/mini-PC) instead of taking Rancher's marketing at face value, so real resource consumption, startup time, and workload performance were compared against K8s on limited hardware.

A service needed a real LAN IP (bypassing Docker bridge's default NAT) so internal IoT devices could reach it directly, so bridge, overlay, macvlan, and host networking modes were surveyed to find the right fit.

A database server started dropping connections during peak hours (~5000 concurrent connections), suspected to be default kernel limits (somaxconn, file descriptors) rather than the application, so sysctl and kernel parameter tuning were carried out.