Blog
From Memory to PR Autonomy: What I Built on Claude Code
· 12 min read
Three annoyances, one system, no new tool: how a coding agent went from forgetting everything each morning to reviewing its own pull requests, and the three different ways I learned to steer it along the way.
Claude Code Memory: A 5-Layer Setup
· 6 min read
How I keep a coding agent consistent across projects, sessions, and teammates: a 5-layer memory architecture, and the promotion loop that keeps it from turning into a graveyard of half-useful notes.
How We Replaced Synchronous APIs with NATS and JetStream
· 6 min read
Untangling a microservice estate that had grown too tightly coupled: moving Brokee's internal communication from synchronous request/response to NATS and JetStream, and what shipping it with a teammate actually looked like.
How We Reduced Our Google Cloud Bill by 65%
· 9 min read
A practical GKE cost-optimization writeup: spot instances via temporary stable nodes, consolidating dev and prod with vcluster, and cutting Cloud Logging volume from GKE control-plane noise.
GCP Workforce Identity Federation for Isolated Candidate Environments
· 2 min read
Logging skills-assessment candidates into the Google Cloud console without requiring a Google account, using Workforce Identity Federation and per-test project isolation.
Isolating Candidate Test Environments Across AWS, GCP, and Azure IAM
· 2 min read
Three cloud providers, three different IAM models for the same problem: giving each candidate an isolated, disposable cloud environment for a skills assessment, and getting them logged in without a real cloud account.
Recording Candidate Terminal Sessions with asciinema
· 3 min read
How we added session replay and AI-generated summaries to technical skills assessments, so reviewers get more signal without rewatching 30-60 minutes of terminal activity per candidate.
Creating Docker config.json for External Systems
· 1 min read
A short tutorial for building a Docker config.json with base64-encoded registry credentials by hand -- the format external systems like Kubernetes image pulls expect, which the credential-helper-based config Docker generates by default does not match.
Monitoring Kubernetes Ingress with BlackboxExporter
· 2 min read
Using Prometheus's Kubernetes service discovery to probe Ingress resources automatically instead of hand-maintaining a static endpoint list, including TLS expiry detection and how to debug what Prometheus actually discovers.
Multitenancy on Kubernetes with Istio, External Authentication Server and OpenID Connect (Part 2 — Authorization)
· 5 min read
Part 2 of 2. Once a user is authenticated, how do you decide what they're allowed to reach? Istio ServiceRole and ServiceRoleBinding for tenant-level access, then header-based and path-based routing to isolate individual users within a tenant.
Multitenancy on Kubernetes with Istio, External Authentication Server and OpenID Connect (Part 1 — Authentication)
· 5 min read
Part 1 of 2. How HAL24K's data-science platform authenticates users across tenants on Kubernetes: OpenID Connect, an External Authentication Server (EAS) fronted by an Istio envoy filter, and per-tenant OIDC client configuration.
Kafka From Zero to Hero: Zero-Downtime Kafka Migration
· 15 min read
Blockport's Kafka story end to end: a managed cluster that turned out to be operationally opaque, the replication and high-availability issues that forced a rebuild from scratch with Terraform and Ansible, and migrating a live cluster to it with zero message loss and zero downtime.
Upload Jenkins Secret File Credential via API
· 4 min read
Jenkins documents the credentials API for XML and simple JSON cases, but not for uploading a secret file. Capturing the real browser request, then paring it down, gets to a single working curl command.
Debug JAR Files in IntelliJ IDEA
· 1 min read
Launch a packaged JAR in JDWP debug mode, then attach IntelliJ to the running JVM as a remote debugger -- for the case where you cannot just run a main() method directly from the IDE.