Technical Scratchpad

10 Sep 2026

Atlantis – Preventing Arbitrary Scripts/Programs from Running using Open Policy Agent (OPA) Policies

CI/CD components are prime targets for malicious actors as they often have elevated permissions. In fact, Atlantis documents it right at the top of it’s Security page. In this post, I explain how to configure Atlantis server to prevent the dangerous “external” data source from being executed by Atlantis.
(read more)
27 Aug 2026

Using GitLab CI Job Token To Create/Close Merge Requests

Since GitLab 18.4, it is possible to use the default CI Job Token to create/close Merge Requests.
(read more)
28 Jun 2026

Setting Up Gitea with Atlantis (Terraform CI for Pull Requests)

I found the official documentation a bit too generic / confusing, so decided to jot down how I set mine up. Gitea will be running directly on the host, while Atlantis as a podman container on the same host.
(read more)
15 Jun 2026

Automatically Create Mountpoint Directories for Remote Filesystems in /etc/fstab

Before I learnt this approach, one of the challenges I faced when building a reusuable VM image is to define the mountpoints ahead of time. I found this breakthrough when I read more about systemd’s mount unit configuration, which specifically states that under the [Mount] section:
(read more)
05 May 2026

How Do du and duc Work, and Which One Should I Choose?

GNU Core Utilities’s du is one of the most widely used Linux utility to estimate how much disk space a particular set of files are using on a filesystem. I chanced across duc (du-cached) and wanted to give it a try to evaluate its effectiveness against a large filesystem. But I kept wondering how du and duc worked, and which one was really faster when calculating disk utilization.
(read more)
26 Apr 2026

TIL: Separate OpenTelemetry Receivers That Scape, from Those That Receive Signals from Clients

If both types of receivers are contained within the configuration file, it will result in duplicated processing of scraped signals by multiple collectors. This may result in unintended outcomes, such as excessively scaling out a downstream system, or sinking twice as many logs into a third party storage service.
(read more)
24 Feb 2026

Certified Argo Project Associate (CAPA)

I took and passed the Certified Argo Project Associate certification exam offered by Linux Foundation. I believe that my knowledge in Kubernetes allowed me to pick this up quickly, and focus solely on the Argo specific nuances. These are the resources I used:
(read more)
18 Feb 2026

Install Argo Project Tools in a Single Kubernetes Cluster, and Expose Their Dashboards Via MetalLB and NGINX Ingress Controller

The Argo project is currently made up of four different tools – Workflows, CD, Rollouts, and Events. While there are UI dashboards available for each tool, the way they are meant to be used or made available are not quite standardized. In the world of Platform Engineering, I believe that there is value in installing all four tools in a single Kubernetes cluster. This Kubernetes cluster can then be made available to business teams and/or the broader organization. In this post, I explain how to set up an Argo Kubernetes cluster that comprises of all 4 tools (Workflows, Events, Rollouts,…
(read more)
14 Jan 2026

AWS Certified Security – Specialty (SCS-C03)

This certification focuses on the skills required to create and implement security solutions in the AWS cloud. As with the more advanced levels, it also looks at how to implement these solutions at scale – both multi-region and multi-account. I spent 4 months preparing for this certification, and these are the resources I used.
(read more)
15 Dec 2025

Ordering Systemd Units With Wants, Requires, Requisite, Before, and After

When you need to define the startup sequence of your Systemd units, you have a few options under the [Unit] section that define the ordering and/or dependency. Ordering is the sequence of which the Systemd units start, while dependency is the relationship between two (or more) units.
(read more)
06 Dec 2025

TIL: Logs in Cloudwatch Log Group Take a Few Minutes Before Showing up in Cloudwatch Logs Insights Query

TL;DR – When CloudWatch Logs receives the logs, the logs take a few minutes before it’s available to query via Log Insights. I found that waiting for 3 minutes before querying works reliably. If you want real time event processing, use a service like AWS Kinesis.
(read more)
01 Dec 2025

Enabling Huge Pages for Gitlab Runner Jobs in AWS EKS with Karpenter

This post explains how to enable huge pages for GitLab Runner jobs using the Kubernetes exectuor, deployed on an AWS Elastic Kubernetes Service (EKS) cluster using Karpenter.
(read more)
23 Nov 2025

Not Authorized to Perform ScheduleQuery on CloudWatch Log Group

TL;DR: If you get ScheduleQuery IAM permission error for CloudWatch Logs, check your Log Group name and/or the logs:StartQuery permission.
(read more)
16 Nov 2025

The Directories Where Linux Containers (LXC) Are Defined At

Depending on how Linux Containers are created, these are the file paths they reside on.
(read more)
18 Oct 2025

A Fully Automated Installation of Ubuntu Server – Combining Netboot Tarball via PXE with Autoinstall Configuration File

In a previous post, I explained how to use the Ubuntu Server Netboot Tarball to install the OS via PXE. However, it still requires the sysadmin to have access to the physical machine. This is not scable. By using an Ubuntu autoinstall configuration file, it is possible to automate the entire installation process completely. In this post, I first explain how Ubuntu autoinstall works, and then how have I set it up for my homelab.
(read more)