CloudNativePG Part 7: Turning Off the Thing You Built Four Months Ago
Deleting the legacy PostgreSQL instance took four commands. Proving it was safe to delete took a day and eleven read-only checks.
CloudNativePG Part 6: Migrating Umami Without Losing a Row
Moving a live 10 MB database onto CloudNativePG in under six minutes, and proving the verification harness could actually fail before trusting it.
Secret Management Part 5: Replacing OpenBao's kv-admin Token with a Login
kv-admin had absorbed root's privileges and carried a deadline nobody tracked. A userpass login removed both — and the escalation made it possible.
CloudNativePG Part 5: lldap's Database Goes First
LLDAP becomes the first real tenant on the shared CNPG cluster, and Authelia moves from a file to LDAP via one deadlocked rollout and a self-inflicted outage.
Certificate Management Revisited: My “Internal CA” Wasn't a CA
A cert-manager selfSigned ClusterIssuer sat unused for 161 days before I discovered it couldn't provide the trust anchor my first real internal service needed. Here's the two-object bootstrap that turns it into a usable internal CA — and the openssl test that proves the difference.
CloudNativePG Part 4: Breaking a Throwaway Database on Purpose
Extending Prometheus and Alertmanager to cover CloudNativePG, then chaos-testing failover, node loss, and restores against a throwaway database.
CloudNativePG Part 3: Installation and Exposing It with MetalLB
Installing CloudNativePG on Bletchley: the Cluster, MetalLB exposure, automated backups, and every real bug hit getting there.
CloudNativePG Part 2: Labeling Nodes and Auditing Existing Workloads
Labeling Bletchley's two boards for CloudNativePG, auditing existing workloads for the same partition risk, and confirming there's room for it.
CloudNativePG Part 1: Planning Highly Available PostgreSQL Across Two TuringPi Boards
Same partition, opposite outcome, depending only on which board the primary happens to be on.
Silent Failures: Monitoring Stateful Services After Restarts
Garage's node ID reverted, Longhorn backups failed silently, and OpenBao turned out to have the same unmonitored risk — three alerts, two reactive and one proactive.
Fixing a Postgres Backup Failure: Region Mismatch and a Missing NAS Copy
A LogQL finding led to a one-line AWS CLI region fix for postgres housekeeping — and uncovered a second gap: backups never synced to the NAS.
Longhorn Disk Alerting: Getting the Signal Right
Replacing misleading volume-level Longhorn alerts with disk-level rules, recalibrating snapshot overhead to 50%, and how an unrelated incident accidentally produced the baseline data needed.