The Workstation Blog
Kubernetes
Posts tagged Kubernetes.
Observability Is Not Optional: Make It a Business Standard
Why fragmented monitoring creates blind spots, duplicate spend, and slow incidents — and how to make centralised observability a non-negotiable company standard.
Balinder WaliaRead 
WSL Vault for Compliance: One Tenant Never Opens Another’s Secrets
How WSL Vault keeps app, team, and environment tenants cryptographically isolated — so a stolen root-style token cannot empty the estate — and why dual-tenant control beats secrets sprawl.
Balinder WaliaRead 
Workstation AI Shop: Promoting the AI Sales Storefront Through int → test → acc → prod
Workstation AI Shop sells GPU machines with a fully autonomous AI Sales Agent that configures the basket. See how Ring Promoter moves each build through int → test → acc → prod — with Orbit screenshots release engineers and stakeholders share.
Balinder WaliaRead 
Ring Promoter vs Argo CD, Kargo and CI: Which Tool Answers Which Release Question
Argo CD syncs, CI builds, Ring Promoter promotes. A fact-checked look at the comparison, its honest limits, which tool fits, and how to record the choice as an ADR.
Balinder WaliaRead 
Stop paying for idle CI: GitLab Runners on Kubernetes
Most teams pay for CI as if every night were still Monday morning. GitLab Runners on Kubernetes flip that: ephemeral job pods, scale up under load, scale down when quiet.
Balinder WaliaRead 
Ring Promoter v1.0.2 — Rings, Orbit and Lanes Side by Side
Ring Promoter v1.0.2 ships Orbit and Lanes side by side — pause on Orbit for the fleet, flip to Lanes when you need the matrix.
Balinder WaliaRead 
WSLVault: Why AI Agents Need Cryptographic Secrets Isolation
AI agents use secrets at machine speed across tools and tenants. WSLVault seals per tenant so a shared platform never leaks another team's plaintext.
Balinder WaliaRead 
WSLVault: Steal the Server. Not the Secrets.
WSLVault seals secrets before they touch disk — DEK to tenant KEK to root KEK — so a stolen host still leaves attackers with ciphertext they cannot open.
Balinder WaliaRead 
Faster WSLProxy Deploys: Prebuilt Images, Build Cache — and Using AI So the Pipeline Work Actually Ships
Workstation WSL Proxy: compile OpenResty once into bwalia/wslproxy-openresty, warm Buildx/GHA layers, extract on bare metal, prefer DEPLOY_MODE=code — and why AI-assisted delivery made this cross-cutting work finishable.
Balinder WaliaRead 
AI GPU Workstations: NVIDIA DGX Spark/Station & Mac Studio M5
How Workstation maps NVIDIA DGX Spark, DGX Station, and Mac Studio M5 into AI Labs and SME packages — factual positioning, no invented prices.
Balinder WaliaRead 
WSLProxy WAF Engine v2: Enterprise Enforcement You Can Explain
Workstation WSL Proxy WAF Engine v2: governed stages and signatures on the OpenResty hot path — explainable enforcement with support IDs.
Balinder WaliaRead WSL Proxy WAF: Explainable Web Application Firewall at the Edge
Workstation WSL Proxy WAF: governed stages and signatures on a live-config OpenResty edge — monitor or block, with explainable support IDs.
Balinder WaliaRead 
Every Release Earns Production: Making Promotions Boring and Safe
Ring Promoter makes promotion a protocol: health-gated hops through int → test → acc → prod, auto-rollback, and full history — every release earns production.
Balinder WaliaRead 
Ring Promoter — QA Gates Before Production
Ring Promoter QA gates: auto-promote early rings, keep a human gate before prod, and treat health plus version checks as first-class quality gates.
Balinder WaliaRead 
Turbocharging LLMs
Workstation on turbocharging LLMs: PagedAttention paging for KV cache, vLLM serving, Self-Debugging for agents, PowerInfer token rates, and EG-MLA memory cuts — with production trade-offs.
Balinder WaliaRead 
Ring Promoter: Modern CI/CD You Cannot Miss for AI-Powered Deployments
Ring Promoter is the modern CI/CD control plane for AI-powered deployments: shared rings, health gates, version verification, auto-rollback, and multi-app promote.
Balinder WaliaRead 
Workstation WSL Proxy: API Gateway, CDN & Agent Edge
Workstation WSL Proxy (WSLProxy) is a complete API gateway and CDN edge: live routing, WAF, cache, multi-POP DNS, MCP — with Agents Gateway and MCP Gateway in progress.
Balinder WaliaRead 
KubePilot: CoPilot, Pilot & AutoPilot for Faster Kubernetes Incidents
KubePilot helps SRE, DevOps, and platform teams move from noisy cluster signals to a safe fix — CoPilot, Pilot, and AutoPilot. Open source at kubepilot.org.
Balinder WaliaRead 
Agentic AI Security: MCP OAuth, VPN & HashiCorp Vault Leases
Secure enterprise AI agents with MCP OAuth 2.1, VPN-isolated tools, and HashiCorp Vault leases that auto-rotate and expire — plus Claude, OpenAI, and Cursor recommendations.
Balinder WaliaRead 
What is Deep Learning? Workstation Guide for Builders & Business
Workstation rewrite of AWS What is Deep Learning: neural networks, generative AI, vision/speech/NLP/recommendations, and how teams ship DL in the cloud or on Kubernetes.
Balinder WaliaRead 
Kubeflow + Argo CD: GitOps MLOps on Kubernetes
Pair Kubeflow and Argo CD for MLOps on Kubernetes: train and register models in Kubeflow, promote InferenceServices with GitOps, roll back with git revert.
Balinder WaliaRead 
Large Language Models Explained: How LLMs Work and How to Run Your Own on Kubernetes
What are Large Language Models and how do they work? A clear, non-technical explainer for managers and engineers — tokens, embeddings, transformers, training and inference — plus production Kubernetes YAML to deploy your own LLM with Ollama and vLLM.
Balinder WaliaRead 
Couchbase upgrades with CAO pause gates: a support-friendly overview
A support-friendly, SRE-ready overview of Couchbase Server rolling upgrades under the Couchbase Autonomous Operator (CAO), using spec.paused to gate swap-rebalance one node at a time—so you can stabilize, validate health, and keep rollback options open.
Balinder WaliaRead 
NebulaDNS Complete Feature Guide: k3s, Route53, Observability, and Enterprise DNS
Complete tour of NebulaDNS features: API-first control plane, Prometheus metrics, propagation gates, peer fingerprinting, DNSSEC roadmap, Helm/k3s operator story, and how to integrate with AWS Route 53 and CoreDNS.
Balinder WaliaRead NebulaDNS: Why Authoritative DNS Is a Game Changer in the AI Era
NebulaDNS is a safe-Rust authoritative DNS server with an API-first control plane, Prometheus metrics, propagation gates, and Kubernetes-native operations—built for visibility when AI services and agents depend on DNS more than ever.
Balinder WaliaRead 
NebulaCR: Enterprise OCI Registry, Observability, and Compliance Without Compromise
Professional overview of NebulaCR: Rust OCI registry with nebula-registry and nebula-auth, zero-trust OIDC for humans and CI, SCIM lifecycle, Prometheus and OpenTelemetry, multi-region replication, pull-through cache, and Kubernetes Helm deployment—synthesised from the upstream docs/ and README.
Balinder WaliaRead 
NebulaCB: Enterprise-Grade Couchbase Management That Saves the Day
How NebulaCB, the open-source Couchbase mission control from nebulacb.org, helps enterprises upgrade fearlessly, validate XDCR and data integrity, run Kubernetes-native operations, and use local AI (Ollama) for RCA—so teams ship changes without losing data or sleep.
Balinder WaliaRead 
Couchbase High Availability in Production: XDCR, Kubernetes Operator, and Multi-Region Deployment
Complete guide to running Couchbase Server in high availability production environments with XDCR multi-region replication, Couchbase Autonomous Operator on Kubernetes, across AWS, Azure, GCP, and bare metal k3s with Rancher.
Balinder WaliaRead 
Production Database Backup Strategies That Actually Work: MySQL and PostgreSQL
Battle-tested database backup strategies for MySQL and PostgreSQL in production. Covers physical and logical backups, PITR, WAL archiving, automated scheduling, cloud storage, and disaster recovery across AWS, Azure, GCP, and k3s.
Balinder WaliaRead 
Longhorn Storage for Production k3s Clusters: Dynamic PVC Expansion, Replication, and Disaster Recovery
Complete production guide for Longhorn distributed storage on k3s/Rancher clusters. Covers dynamic PVC expansion, multi-region replication, backup to S3/GCS/Azure, disaster recovery, and performance tuning for database workloads.
Balinder WaliaRead 
MongoDB High Availability in Production: Replica Sets, Sharding, and Kubernetes Operators
Complete production guide for MongoDB high availability using Replica Sets, Sharding, MongoDB Community Kubernetes Operator, and Percona Operator across AWS, Azure, GCP, and bare metal k3s with Rancher.
Balinder WaliaRead 
MySQL High Availability in Production: InnoDB Cluster, Group Replication, and Kubernetes Operators
Complete guide to running MySQL in high availability production environments using InnoDB Cluster, Group Replication, MySQL Operator, and Percona XtraDB Cluster across AWS, Azure, GCP, and bare metal k3s with Rancher.
Balinder WaliaRead 
PostgreSQL High Availability with Crunchy Data PGO: Enterprise Kubernetes Deployment
Production guide for deploying highly available PostgreSQL using Crunchy Data PGO (Postgres Operator) across AWS, Azure, GCP, and bare metal k3s/Rancher with comprehensive backup, monitoring, and multi-region strategies.
Balinder WaliaRead