DevOps and Observability
Focused devops and observability articles with clear context, practical examples, source links where needed, and honest limits.
10 articles in this section.
Cardinality budgets for metrics labels
A metric label creates a time series for each value combination, so user IDs, URLs, and error messages can overwhelm storage and query performance.
Database migration observability: know what the deploy is waiting on
Production migrations need timing, lock-wait, progress, and rollback signals so a quiet terminal does not hide blocked traffic.
Kubernetes readiness during graceful shutdown
A terminating pod should become unready before it stops accepting work, then drain within the platform grace period.
Trace sampling: keep rare failures without storing every request
Head sampling controls volume early while tail sampling can retain slow or failed traces after seeing the full outcome.
Docker BuildKit secrets: credentials without image layers
BuildKit secret mounts expose credentials only to the selected build step, avoiding ARG and COPY patterns that persist secrets in history.
pull_request_target security: never run untrusted checkout code
pull_request_target has base-repository privileges, so checking out and executing fork code in that workflow can expose secrets and write tokens.
Pin GitHub Actions by commit SHA without losing updates
Pinning third-party actions to a full commit protects against mutable tags, while automated update PRs keep the pinned revision maintainable.
GitHub Actions OIDC to AWS: deploy without stored access keys
OIDC lets a workflow exchange a signed identity token for short-lived AWS credentials constrained by repository, branch, and environment claims.
SLO burn-rate alerts: page on fast and slow failures
Multi-window burn-rate alerts catch severe outages quickly while still detecting smaller sustained errors before the error budget disappears.
OpenTelemetry baggage: useful context without leaking PII
Baggage propagates across service boundaries, so include only small allow-listed routing context and never user secrets or unbounded identifiers.