Writing on platform engineering, Kubernetes, and building AI-assisted operational tooling.https://lushpenko.dev/https://lushpenko.dev/blog/from-memory-to-pr-autonomy/https://lushpenko.dev/blog/from-memory-to-pr-autonomy/Three annoyances, one system, no new tool: how a coding agent went from forgetting everything each morning to reviewing its own pull requests, and the three different ways I learned to steer it along the way.Fri, 07 Aug 2026 00:00:00 GMThttps://lushpenko.dev/blog/claude-code-memory-a-5-layer-setup/https://lushpenko.dev/blog/claude-code-memory-a-5-layer-setup/How I keep a coding agent consistent across projects, sessions, and teammates: a 5-layer memory architecture, and the promotion loop that keeps it from turning into a graveyard of half-useful notes.Wed, 03 Jun 2026 00:00:00 GMThttps://lushpenko.dev/blog/how-we-replaced-synchronous-apis-with-nats-and-jetstream/https://lushpenko.dev/blog/how-we-replaced-synchronous-apis-with-nats-and-jetstream/Untangling a microservice estate that had grown too tightly coupled: moving Brokee's internal communication from synchronous request/response to NATS and JetStream, and what shipping it with a teammate actually looked like.Wed, 15 Jan 2025 00:00:00 GMThttps://lushpenko.dev/blog/reducing-our-google-cloud-bill-by-65-percent/https://lushpenko.dev/blog/reducing-our-google-cloud-bill-by-65-percent/A practical GKE cost-optimization writeup: spot instances via temporary stable nodes, consolidating dev and prod with vcluster, and cutting Cloud Logging volume from GKE control-plane noise.Tue, 03 Dec 2024 00:00:00 GMThttps://lushpenko.dev/blog/gcp-workforce-identity-federation-for-candidate-environments/https://lushpenko.dev/blog/gcp-workforce-identity-federation-for-candidate-environments/Logging skills-assessment candidates into the Google Cloud console without requiring a Google account, using Workforce Identity Federation and per-test project isolation.Tue, 01 Oct 2024 00:00:00 GMThttps://lushpenko.dev/blog/isolating-candidate-environments-across-aws-gcp-and-azure-iam/https://lushpenko.dev/blog/isolating-candidate-environments-across-aws-gcp-and-azure-iam/Three cloud providers, three different IAM models for the same problem: giving each candidate an isolated, disposable cloud environment for a skills assessment, and getting them logged in without a real cloud account.Wed, 01 Nov 2023 00:00:00 GMThttps://lushpenko.dev/blog/recording-candidate-terminal-sessions-with-asciinema/https://lushpenko.dev/blog/recording-candidate-terminal-sessions-with-asciinema/How we added session replay and AI-generated summaries to technical skills assessments, so reviewers get more signal without rewatching 30-60 minutes of terminal activity per candidate.Fri, 01 Sep 2023 00:00:00 GMThttps://lushpenko.dev/blog/creating-docker-config-json-for-external-systems/https://lushpenko.dev/blog/creating-docker-config-json-for-external-systems/A short tutorial for building a Docker config.json with base64-encoded registry credentials by hand -- the format external systems like Kubernetes image pulls expect, which the credential-helper-based config Docker generates by default does not match.Mon, 15 Mar 2021 00:00:00 GMThttps://lushpenko.dev/blog/monitoring-kubernetes-ingress-with-blackboxexporter/https://lushpenko.dev/blog/monitoring-kubernetes-ingress-with-blackboxexporter/Using Prometheus's Kubernetes service discovery to probe Ingress resources automatically instead of hand-maintaining a static endpoint list, including TLS expiry detection and how to debug what Prometheus actually discovers.Fri, 19 Jun 2020 00:00:00 GMThttps://lushpenko.dev/blog/multitenancy-on-kubernetes-with-istio-part-2-authorization/https://lushpenko.dev/blog/multitenancy-on-kubernetes-with-istio-part-2-authorization/Part 2 of 2. Once a user is authenticated, how do you decide what they're allowed to reach? Istio ServiceRole and ServiceRoleBinding for tenant-level access, then header-based and path-based routing to isolate individual users within a tenant.Wed, 09 Oct 2019 00:00:00 GMThttps://lushpenko.dev/blog/multitenancy-on-kubernetes-with-istio-part-1-authentication/https://lushpenko.dev/blog/multitenancy-on-kubernetes-with-istio-part-1-authentication/Part 1 of 2. How HAL24K's data-science platform authenticates users across tenants on Kubernetes: OpenID Connect, an External Authentication Server (EAS) fronted by an Istio envoy filter, and per-tenant OIDC client configuration.Wed, 02 Oct 2019 00:00:00 GMThttps://lushpenko.dev/blog/kafka-from-zero-to-hero-zero-downtime-kafka-migration/https://lushpenko.dev/blog/kafka-from-zero-to-hero-zero-downtime-kafka-migration/Blockport's Kafka story end to end: a managed cluster that turned out to be operationally opaque, the replication and high-availability issues that forced a rebuild from scratch with Terraform and Ansible, and migrating a live cluster to it with zero message loss and zero downtime.Tue, 21 May 2019 00:00:00 GMThttps://lushpenko.dev/blog/upload-jenkins-secret-file-credential-via-api/https://lushpenko.dev/blog/upload-jenkins-secret-file-credential-via-api/Jenkins documents the credentials API for XML and simple JSON cases, but not for uploading a secret file. Capturing the real browser request, then paring it down, gets to a single working curl command.Wed, 03 Jan 2018 00:00:00 GMThttps://lushpenko.dev/blog/debug-jar-files-in-intellij-idea/https://lushpenko.dev/blog/debug-jar-files-in-intellij-idea/Launch a packaged JAR in JDWP debug mode, then attach IntelliJ to the running JVM as a remote debugger -- for the case where you cannot just run a main() method directly from the IDE.Mon, 18 May 2015 00:00:00 GMT