https://nrnx.dev Notes on building software, the things that broke along the way, and what I learned fixing them. en-us Tue, 08 Sep 2026 00:00:00 GMT https://nrnx.dev/blog/reaching-services-across-clouds https://nrnx.dev/blog/reaching-services-across-clouds Tue, 08 Sep 2026 00:00:00 GMT Naren One load balancer per service, or one Traefik routing by hostname. What each costs, why GKE pods need a masquerade fix, and how names resolve. Kubernetes Infrastructure Networking https://nrnx.dev/blog/gke-to-aks-over-a-vpn https://nrnx.dev/blog/gke-to-aks-over-a-vpn Tue, 28 Jul 2026 00:00:00 GMT Naren Build the tunnel between Google Cloud and Azure with BGP, advertise only what should cross, then test four layers until real traffic flows. Kubernetes Infrastructure Networking https://nrnx.dev/blog/building-an-ai-hyperscaler-on-kubernetes https://nrnx.dev/blog/building-an-ai-hyperscaler-on-kubernetes Thu, 16 Apr 2026 00:00:00 GMT Naren How an AI cloud fits together on Kubernetes, from what customers actually buy and the seven layers between datacenter and console to four products on one GPU pool and how tenants share it safely, the lessons AWS and Google learned about cells and control planes, and what changes with scale. AI Kubernetes Infrastructure https://nrnx.dev/blog/what-an-sbom-is-for https://nrnx.dev/blog/what-an-sbom-is-for Tue, 24 Mar 2026 00:00:00 GMT Naren What goes into a software bill of materials, what having one actually buys you, and the question it still cannot answer. Security Supply Chain https://nrnx.dev/blog/how-rsa-works https://nrnx.dev/blog/how-rsa-works Mon, 05 Jan 2026 00:00:00 GMT Naren Why a padlock anyone can check but only you can close is what actually holds up HTTPS, SSH and signed commits. Cryptography Security https://nrnx.dev/blog/signing-images-with-cosign https://nrnx.dev/blog/signing-images-with-cosign Thu, 20 Nov 2025 00:00:00 GMT Naren From an unsigned image to a keyless signature anyone can verify, using Sigstore's public infrastructure. No key to lose. Security Supply Chain https://nrnx.dev/blog/air-gapped-delivery-with-hauler https://nrnx.dev/blog/air-gapped-delivery-with-hauler Wed, 27 Aug 2025 00:00:00 GMT Naren Declare images and charts in one manifest, package them into a single archive, carry it across, and serve it from a binary with no dependencies. Infrastructure Kubernetes Security https://nrnx.dev/blog/scanning-with-trivy https://nrnx.dev/blog/scanning-with-trivy Mon, 21 Jul 2025 00:00:00 GMT Naren One scanner for container images, dependencies, Terraform and secrets: install it, read its output, and fail a build on the right things. Security Tooling Infrastructure https://nrnx.dev/blog/generating-sboms-with-syft https://nrnx.dev/blog/generating-sboms-with-syft Fri, 06 Jun 2025 00:00:00 GMT Naren Install Syft, scan an image or a directory, choose an output format, and wire it into CI so every build produces one. Security Supply Chain Tooling https://nrnx.dev/blog/building-kubernetes-as-a-service https://nrnx.dev/blog/building-kubernetes-as-a-service Wed, 14 May 2025 00:00:00 GMT Naren What it takes to run managed Kubernetes when you are the cloud, from hosted control planes, cells and etcd to networking, storage, upgrades and tenant isolation without cloud APIs, plus a version small enough to build on a laptop. Kubernetes Infrastructure Platform https://nrnx.dev/blog/deep-sboms-with-cdxgen https://nrnx.dev/blog/deep-sboms-with-cdxgen Thu, 24 Apr 2025 00:00:00 GMT Naren cdxgen reads your lockfiles and build system rather than the finished image. How to run it, and when that difference matters. Security Supply Chain Tooling https://nrnx.dev/blog/cyclonedx-explained https://nrnx.dev/blog/cyclonedx-explained Wed, 19 Mar 2025 00:00:00 GMT Naren How CycloneDX models components, dependencies and vulnerabilities, and when to pick it over SPDX. Security Supply Chain https://nrnx.dev/blog/hello-again https://nrnx.dev/blog/hello-again Sat, 01 Feb 2025 00:00:00 GMT Naren Why I'm starting a blog for the third time, and what I'm going to do differently. Meta https://nrnx.dev/blog/troubleshooting-cluster-failures https://nrnx.dev/blog/troubleshooting-cluster-failures Sat, 14 Dec 2024 00:00:00 GMT Naren When a node, the control plane or the network fails, a structured workflow for finding the cause, and audit logs for reconstructing who did what. Kubernetes https://nrnx.dev/blog/debugging-monitoring-and-logging https://nrnx.dev/blog/debugging-monitoring-and-logging Sun, 24 Nov 2024 00:00:00 GMT Naren A systematic way to debug Pods, Services and Deployments, then the two things that make debugging possible, metrics with Prometheus and Grafana and centralized logs. Kubernetes https://nrnx.dev/blog/spdx-explained https://nrnx.dev/blog/spdx-explained Tue, 12 Nov 2024 00:00:00 GMT Naren Where SPDX came from, how its document model is shaped, and why licence teams reach for it before security teams do. Security Supply Chain https://nrnx.dev/blog/runtime-security https://nrnx.dev/blog/runtime-security Mon, 04 Nov 2024 00:00:00 GMT Naren Watch a running cluster for attacks with Falco, stop running containers from being changed with a read-only root filesystem, and record every API request with audit logs. Kubernetes Security https://nrnx.dev/blog/kubernetes-supply-chain-security https://nrnx.dev/blog/kubernetes-supply-chain-security Tue, 15 Oct 2024 00:00:00 GMT Naren Everything between a commit and a running Pod can be attacked. Minimal and signed images, scanning in CI, locked-down pipelines and secrets, and checks at runtime. Kubernetes Security Supply Chain https://nrnx.dev/blog/k9s-first-ten-minutes https://nrnx.dev/blog/k9s-first-ten-minutes Thu, 26 Sep 2024 00:00:00 GMT Naren Install it, point it at a cluster, and learn the handful of keys that replace most of the kubectl you type. Kubernetes Tooling https://nrnx.dev/blog/pod-security https://nrnx.dev/blog/pod-security Wed, 25 Sep 2024 00:00:00 GMT Naren Enforce Pod Security Standards per namespace, limit what a container can do with AppArmor and seccomp, and isolate untrusted workloads with gVisor or Kata Containers. Kubernetes Security https://nrnx.dev/blog/cis-benchmarks-and-api-access https://nrnx.dev/blog/cis-benchmarks-and-api-access Thu, 05 Sep 2024 00:00:00 GMT Naren Check a cluster against the CIS Kubernetes Benchmark with kube-bench, then control who can do what through the API server with authentication, RBAC and network policies. Kubernetes Security https://nrnx.dev/blog/git-hooks-that-catch-things https://nrnx.dev/blog/git-hooks-that-catch-things Thu, 22 Aug 2024 00:00:00 GMT Naren A pre-commit hook that blocks AWS access key IDs, a commit-msg hook that enforces Conventional Commits, and Husky so a fresh clone arms them by itself. Engineering Security Tooling https://nrnx.dev/blog/multi-container-pods https://nrnx.dev/blog/multi-container-pods Fri, 16 Aug 2024 00:00:00 GMT Naren When to put more than one container in a Pod, the three patterns for doing it, and init containers that run before your application starts. Kubernetes https://nrnx.dev/blog/probes-and-health-checks https://nrnx.dev/blog/probes-and-health-checks Sat, 27 Jul 2024 00:00:00 GMT Naren A running container is not always a working one. Probes tell Kubernetes when to restart a container, when to send it traffic, and when to wait out a slow start. Kubernetes https://nrnx.dev/blog/keeping-a-changelog https://nrnx.dev/blog/keeping-a-changelog Tue, 09 Jul 2024 00:00:00 GMT Naren The six Keep a Changelog categories, why the Unreleased section is the part that makes it work, and what to automate. Engineering Tooling https://nrnx.dev/blog/configmaps-and-secrets https://nrnx.dev/blog/configmaps-and-secrets Sun, 07 Jul 2024 00:00:00 GMT Naren Keep configuration out of your images with ConfigMaps, handle passwords and keys with Secrets, and know what base64 does and does not protect. Kubernetes Security https://nrnx.dev/blog/upgrades-and-etcd-backups https://nrnx.dev/blog/upgrades-and-etcd-backups Mon, 17 Jun 2024 00:00:00 GMT Naren Upgrade a kubeadm cluster one minor version at a time, control plane first, then take and restore etcd snapshots, because etcd holds the cluster's entire state. Kubernetes Infrastructure https://nrnx.dev/blog/openssl-recipes https://nrnx.dev/blog/openssl-recipes Sat, 01 Jun 2024 00:00:00 GMT Naren Generate a key, make a CSR, inspect a certificate, debug a TLS handshake, and convert between the formats that keep breaking. Cryptography Security Tooling https://nrnx.dev/blog/building-a-cluster-with-kubeadm https://nrnx.dev/blog/building-a-cluster-with-kubeadm Tue, 28 May 2024 00:00:00 GMT Naren Prepare the nodes, install a container runtime and the Kubernetes packages, bootstrap the control plane, add a network plugin and join the workers. Then what each core component does. Kubernetes Infrastructure https://nrnx.dev/blog/persistent-storage https://nrnx.dev/blog/persistent-storage Wed, 08 May 2024 00:00:00 GMT Naren A container loses its files when it stops. Volumes, PersistentVolumes, PersistentVolumeClaims and StorageClasses are how Kubernetes keeps data that has to outlive it. Kubernetes Infrastructure https://nrnx.dev/blog/network-policies https://nrnx.dev/blog/network-policies Thu, 18 Apr 2024 00:00:00 GMT Naren Every Pod can reach every other Pod by default. Network policies cut that down to what you allow, starting from a default deny. Kubernetes Networking Security https://nrnx.dev/blog/reading-the-source https://nrnx.dev/blog/reading-the-source Mon, 15 Apr 2024 00:00:00 GMT Naren Docs tell you the happy path. The source tells you what actually happens when you leave it. Engineering TypeScript https://nrnx.dev/blog/services-and-ingress https://nrnx.dev/blog/services-and-ingress Fri, 29 Mar 2024 00:00:00 GMT Naren Give a changing set of Pods one stable address with a Service, choose the right Service type, and route outside traffic by host and path with Ingress. Kubernetes Networking https://nrnx.dev/blog/deployments-jobs-and-cronjobs https://nrnx.dev/blog/deployments-jobs-and-cronjobs Sat, 09 Mar 2024 00:00:00 GMT Naren Run applications that stay up with Deployments and the ReplicaSets behind them, and tasks that finish with Jobs and CronJobs. Kubernetes https://nrnx.dev/blog/cost-of-a-migration https://nrnx.dev/blog/cost-of-a-migration Tue, 05 Mar 2024 00:00:00 GMT Naren The migration itself takes a week. Deleting the old thing takes a year. Engineering Infrastructure https://nrnx.dev/blog/pods-yaml-and-namespaces https://nrnx.dev/blog/pods-yaml-and-namespaces Sun, 18 Feb 2024 00:00:00 GMT Naren What a Kubernetes object is, how a YAML manifest describes one, and the first two objects you will create, the Pod and the namespace. Kubernetes https://nrnx.dev/blog/your-first-kubernetes-cluster https://nrnx.dev/blog/your-first-kubernetes-cluster Mon, 29 Jan 2024 00:00:00 GMT Naren Install kubectl, then start a local cluster with Minikube or Kind and check that it answers. Kubernetes Tooling https://nrnx.dev/blog/what-is-kubernetes https://nrnx.dev/blog/what-is-kubernetes Tue, 09 Jan 2024 00:00:00 GMT Naren Why containers need something to run them in production, and the two halves of every cluster, the control plane that decides and the worker nodes that do the work. Kubernetes https://nrnx.dev/blog/civo-presigned-urls https://nrnx.dev/blog/civo-presigned-urls Wed, 15 Mar 2023 00:00:00 GMT Naren Upload a file to a Civo object store with s3cmd, then hand out a link that works for exactly one hour and then stops. Infrastructure Tooling Security