Le blog Workstation
Kubernetes
Articles étiquetés Kubernetes.
Gateway API Replaces Ingress: A Step-by-Step Migration Playbook
Ingress NGINX is retired and Ingress is frozen. This playbook maps Ingress fields and annotations to Gateway and HTTPRoute, flags the ingress-nginx behaviours that break, and walks through conversion, side-by-side testing, weighted cutover and rollback.
Decoupling Network Policy in Kubernetes: One Owner per Rule
Network rules scattered across annotations, app config and stray NetworkPolicies slow every change. Here is how to split them into layers with one owner each, using ClusterNetworkPolicy, NetworkPolicy and Gateway API, plus a step-by-step migration playbook.
One Sign-In for Every App, Run on Our Own Cluster
Five demo apps in five languages never see a password and never talk to Google: they send users to a self-hosted OpsAPI, which signs them in and hands back a token the app checks with one API call. What it costs to add an app, why admin dashboards belong behind a VPN or zero-trust broker, and the honest limits.
Balinder WaliaLire 
Gateway API Shifts Cluster Networking: An Ownership Model for the Edge
Ingress is frozen and Ingress NGINX is retired. Gateway API replaces one shared object with resources owned by platform and application teams, joined by explicit handshakes. Here is what that means for platform design, RBAC, topology and CRD ownership.
MCP for DevOps: Give Agents Pipeline Context Without the Keys
How platform teams can use the Model Context Protocol safely: start with read-only servers and scoped identities behind a gateway, trace every tool call, and add write tools only behind human approval. Includes RBAC, tool and task examples.
AWS Resilience Hub: Keep Workload Scope and Recovery Targets Aligned
A practical guide to the September 2026 Resilience Hub features: scope EKS services with labels, use dependency discovery and insights to find hidden coupling, classify hard and soft dependencies, and share one resilience policy across AWS accounts.
Observability Is Not Optional: Make It a Business Standard
Why fragmented monitoring creates blind spots, duplicate spend, and slow incidents — and how to make centralised observability a non-negotiable company standard.
Balinder WaliaLire 
WSL Vault for Compliance: One Tenant Never Opens Another’s Secrets
How WSL Vault keeps app, team, and environment tenants cryptographically isolated — so a stolen root-style token cannot empty the estate — and why dual-tenant control beats secrets sprawl.
Balinder WaliaLire 
Workstation AI Shop: Promoting the AI Sales Storefront Through int → test → acc → prod
Workstation AI Shop sells GPU machines with a fully autonomous AI Sales Agent that configures the basket. See how Ring Promoter moves each build through int → test → acc → prod — with Orbit screenshots release engineers and stakeholders share.
Balinder WaliaLire 