Mirav Gokani

The scariest config drift is the one that "𝘄𝗼𝗿𝗸𝗲𝗱 𝘆𝗲𝘀𝘁𝗲𝗿𝗱𝗮𝘆". It starts with one innocent 𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗮𝗽𝗽𝗹𝘆. I’ve seen this movie too many times. A team ships a clean demo. Manifests are in Git. Everyone feels mature. Then production happens. A node goes bad at 2 AM. Someone “quickly” patches a Deployment. Another person tweaks an Ingress to stop the bleeding. A week later, the cluster is stable… but Git is lying. Next deploy? Surprise 𝗿𝗼𝗹𝗹𝗯𝗮𝗰𝗸 𝘁𝗼 𝗮𝗻 𝗼𝗹𝗱𝗲𝗿 𝗿𝗲𝗮𝗹𝗶𝘁𝘆. And now you’re debugging the difference between “𝘄𝗵𝗮𝘁’𝘀 𝗿𝘂𝗻𝗻𝗶𝗻𝗴” 𝗮𝗻𝗱 “𝘄𝗵𝗮𝘁 𝘄𝗲 𝘁𝗵𝗶𝗻𝗸 𝗶𝘀 𝗿𝘂𝗻𝗻𝗶𝗻𝗴”. That’s drift. 𝗡𝗼𝘁 𝗮 𝗬𝗔𝗠𝗟 𝗽𝗿𝗼𝗯𝗹𝗲𝗺. 𝗔 𝗽𝗿𝗼𝗰𝗲𝘀𝘀 𝗽𝗿𝗼𝗯𝗹𝗲𝗺. Git must be the only change door. If a change can happen outside Git, drift is guaranteed. Break glass is fine, but it must create a PR after the incident, every time. Pull beats push in production. Let the cluster reconcile from Git. CI pushing directly to clusters is how credentials spread and audits become a bedtime story. Separate platform from app config. Platform owns policies, ingress classes, observability, base RBAC. Apps own their deployables. Mixed ownership is 𝗵𝗼𝘄 “𝘀𝗺𝗮𝗹𝗹 𝗰𝗵𝗮𝗻𝗴𝗲𝘀” 𝗯𝗲𝗰𝗼𝗺𝗲 𝗴𝗹𝗼𝗯𝗮𝗹 𝗼𝘂𝘁𝗮𝗴𝗲𝘀. Promote by PR, not copy paste. Dev, stage, prod should differ through overlays or templates, not duplicated files that drift silently over months. Guard merge like it’s deploy. In GitOps, merge often equals rollout. Put policy checks, security scanning, and required reviewers at merge time. Make drift visible. Reconciliation should surface “desired vs live” differences and alert on unexpected divergence. If drift is invisible, it becomes culture. Be strict about what belongs in Git. Secrets should not be raw YAML. Use encryption or external secret management workflows, and document the boundary. Production readiness mini checklist   • PR only changes with required reviews and automated checks   • Defined break glass process that ends in a PR   • Continuous reconciliation plus drift alerts routed to on call   • Clear environment promotion path (same mechanism, different values)   • Secrets handled safely (encrypted manifests or external secret manager) My Demo to Production rule is simple: 𝗽𝗿𝗼𝗱 𝘀𝗵𝗼𝘂𝗹𝗱 𝗻𝗲𝘃𝗲𝗿 𝗯𝗲 “𝗵𝗮𝗻𝗱 𝗰𝗿𝗮𝗳𝘁𝗲𝗱”. 𝗜𝗳 𝘆𝗼𝘂𝗿 𝗰𝗹𝘂𝘀𝘁𝗲𝗿 𝗻𝗲𝗲𝗱𝘀 𝗺𝗮𝗻𝘂𝗮𝗹 𝗹𝗼𝘃𝗲 𝘁𝗼 𝘀𝘂𝗿𝘃𝗶𝘃𝗲, 𝗶𝘁’𝘀 𝗻𝗼𝘁 𝗮 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺, 𝗶𝘁’𝘀 𝗮 𝗽𝗲𝘁. What’s the biggest source of drift in your world: emergency patches, env differences, or shared cluster ownership? #GitOps #Kubernetes #PlatformEngineering

1

The telecom giant also touted two recent AI industry benchmarks to its name. Its Ask Data with Relational Knowledge Graph received plaudits on the Spider 2.0 text to SQL accuracy leaderboard, while its fine-tuned large language model (LLM) based on Google’s Gemma, Gemma-3-4B-IT, came out on top for root-cause analysis (RCA) tasks in 5G networks.

7

🌉 Bridging the Visibility Gap in Distributed Engineering Teams 🌍 Distributed teams don’t fail because of distance. 🔍 They struggle when impact becomes invisible. This white paper outline: ❓ What creates the visibility gap 🎯 Why it impacts alignment, trust, and productivity 🛠️ How the A.I.R. Framework helps bridge it:     💡 Asynchronous Brilliance     🤝 Intentional Touch Points     🌐 Relational Presence 📣 Visibility isn’t about being louder.  🏗️ It’s about making work, intent, and outcomes consistently visible—by design. 📄 Refer to the attached PDF for the full framework. (Refer Comments Section) #DistributedEngineering #RemoteTeams #EngineeringLeadership #Visibility #AIRFramework

13

1 Comment

Network bottlenecks explained: a bottleneck is any point where demand exceeds throughput, increasing latency, jitter, or packet loss. For CTOs and infrastructure architects, the key is to stop guessing and isolate the constraint in layers. Start with symptoms and scope: is it app-wide, site-specific, or time-bound? Then validate the path end-to-end: client → access → core → WAN/Internet → service. Measure utilization, errors/drops, queueing, and retransmits at each hop. Common root causes: 1) Oversubscribed uplinks (access-to-core, DC edge, VPN concentrators) 2) Mis-sized MTU/MSS causing fragmentation/retransmits 3) Asymmetric routing and stateful devices 4) Noisy neighbors in hybrid infrastructure and shared links 5) Poor capacity planning: peaks exceed design assumptions Operational fix: add observability (flow + metrics + logs), define SLOs, and make change management measurable with before/after baselines. Your network design should make constraints obvious, not hidden. What’s the most frequent bottleneck you see in IT operations today? #InfrastructureArchitecture #NetworkDesign #Observability #CapacityPlanning #HighAvailability

1

💡 Lately, it’s been all about building stability, one cluster at a time. The past few weeks have been an interesting ride working across multiple Flowable domains (Funding, Communications, Claims, CDP) while upgrading to newer Flowable 3.17.9 stacks and ensuring everything runs smoothly on AWS EKS. A few highlights and lessons from the trenches: Amazon Web Services (AWS) EKS isn’t just about pods running it’s about what happens when they don’t. Digging deep into CrashLoopBackOffs, kube2iam trust issues, Secrets Manager access chains, and CPU/memory tuning taught me how even one missing role policy can ripple through an entire system. ⚙️ Upgrading workflows = upgrading thinking. Every Flowable version brings subtle shifts handling async jobs differently, changing payload contracts, or reworking interceptors. Learning to adapt and refactor custom Service Invocation logic to align with 3.17+ standards was challenging but rewarding. 🔄 Automation and observability go hand in hand. Refined our Grafana and New Relic dashboards to track pod behavior, async job retries, and deployment patterns because real DevOps maturity isn’t about avoiding issues; it’s about detecting and learning from them early. 💪 Takeaway: Cloud engineering isn’t just about writing code it’s about connecting dots across IAM, EKS, Java, and CI/CD until everything hums in sync. #AWS #EKS #Flowable #Java21 #SpringBoot #DevOps #CloudEngineering #Automation #Kubernetes #KnowledgeSharing #ContinuousImprovement TEKsystems Dexian Beacon Hill SilverSearch, Inc. Akkodis

15

Cloudflare has made a significant shift in default settings for AI crawlers, moving from "index freely" to "block → license → pay." In this new setup, approximately 20% of the web, particularly content behind Cloudflare, is now shielded from unauthorized model training. Access is redirected through a "Pay Per Crawl" marketplace. From my perspective, this move represents a strategic maneuver, positioning Cloudflare at a crucial junction between AI labs and valuable data streams. While the previous unregulated scraping approach had its advantages, sustainability was always a concern. A structured framework is essential to safeguard content creators while fostering responsible AI advancements. The landscape of the open web is evolving from being merely searchable to becoming licensable, with Cloudflare taking a proactive stance in this transformation. Will their product strategy work? This remains to be seen. For further insight please refer to the article on Business Insider. https://lnkd.in/dmHvnMWQ #Cloudflare #GenAI #DataEconomy #ContentProtection #ProductStrategy

10

In our work with Ericsson, we handle complex, multi-environment Kubernetes deployments daily. Here's how Helm helps me. to tackle real challenges: Scenario 1: Same App, Different Environments We maintain separate values-*.yaml files for dev, staging, and prod to manage replicas, image tags, and configs — no duplication, just clean overrides. Scenario 2: CI/CD Image Tag Injection Every GitLab pipeline pushes a unique image tag. Scenario 3: Secure Secrets Handling No plain-text secrets! We use helm-secrets + SOPS to encrypt credentials and decrypt them only during deployment. Scenario 4: Blue-Green Deployments To avoid downtime, we deploy a parallel version and switch traffic using NGINX Ingress. Helm makes it smooth and repeatable. Scenario 5: Quick Rollbacks & Debugging Any issue? We run helm template to validate rendered manifests, and helm rollback to instantly revert if needed. #Helm #Kubernetes #DevOps #CI_CD #CloudNative #InfraAsCode #K8sBestPractices #ProductionReady

10

Because of my interest towards infrastructure, majorly around compute and storage, I've many times been slow at learning how the networking functions in the background. One such thing to get my head around was BGP in the datacenter. I was filled with questions like: What and why is BGP, especially for Kubernetes clusters in the datacenter ? What is this TOR that people keep talking about ? Why go with leaf and spine ? Why to use BGP with it ? What benefits it could have ? Why have pod / services exposed to outside without a proxy like we usually did with an ingress. Learning Kubernetes, I've always heard, Pod and Service IPs are not routable from the outside the cluster. But after learning about BGP, it changed from "they are not routable from outside the cluster, to it depends." And this lab from cilium really reinforce this learning and opened my mind about new possibilities of L3 routing, and how important it can be when you want to scale. TL;DR -> Pod in different Kubernetes clusters can communication via their IPs. Take the lab here: https://lnkd.in/dnWmhdSx #Cilium #eBPF #Kubernetes #Security #CloudNative #DevOps

38

1 Comment