CloudArchitecture

Kubernetes 1.33 practical insights for developers and Ops

As cloud-native technologies rapidly advance, Kubernetes stands out as a fundamental orchestrator, persistently evolving to address the intricate requirements of modern applications. The arrival of version 1.33, codenamed “Octarine” and released on April 23, 2025, marks another significant stride in this journey. With 64 enhancements spanning security, scalability, and the developer experience, this isn’t merely an incremental update; it’s a thoughtful refinement designed to make our digital infrastructure more robust and intuitive. Let’s explore the most impactful upgrades and understand their practical significance for those of us building and maintaining systems in this ecosystem.

Resources adapting seamlessly with In-Place vertical scaling

A notable advancement in Kubernetes 1.33 is the beta introduction of in-place vertical scaling. This allows pods to adjust their CPU and memory allocations without the disruption of a restart. Consider the agility of upgrading your laptop’s RAM or CPU while you’re in the middle of a crucial video conference, with no need to reboot and rejoin. For applications experiencing unpredictable surges or lulls in demand, this capability means resources can be fine-tuned dynamically. The direct benefits are twofold: reduced downtime, ensuring service continuity, and minimized over-provisioning, leading to more efficient resource utilization. This isn’t just about saving resources; it’s about enabling applications to breathe, to adapt instantaneously to real-world demands, ensuring a consistently smooth experience.

To experiment with this, enable the InPlacePodVerticalScaling feature gate and patch a running Pod’s resources.requests to observe Kubernetes manage the change live.

Sidecar containers reliable companions now generally available

Sidecar containers, those trusty auxiliary units that handle tasks like logging, metrics collection, or traffic proxying, have now graduated to General Availability (GA). They are implemented as a specialized class of init containers, distinguished by a restartPolicy: Always, ensuring they remain active throughout the entire lifecycle of the main application pod. Think of a well-designed multitool, always at your belt; it’s not the primary focus, but its various functions are indispensable for the main task to proceed smoothly. This GA status provides a stable, reliable contract for developers building layered functionality, such as service mesh proxies, log shippers, or certificate renewers, without the need for custom lifecycle management scripts. It’s a commitment to dependable, integrated support.

Enhanced control over batch processing with indexed jobs

Indexed Jobs also reach General Availability in this release, bringing two significant improvements for managing large-scale parallel tasks. Firstly, retry limits can now be defined per index. This means each task within a larger job can have its backoffLimit. It’s akin to a relay race where each runner has a personal coach and strategy; if one runner stumbles, their specific recovery plan kicks in without automatically sidelining the entire team. Secondly, custom success policies offer more nuanced control over what constitutes a completed job. For instance, you might define success as “at least 80 percent of tasks must be completed successfully,” or specify that certain critical tasks absolutely must be finished. For complex data pipelines, these enhancements mean they can fail fast where necessary for specific tasks, yet persevere resiliently for others, ultimately saving valuable time and compute resources.

Service account tokens are more secure and informative

In the critical domain of security, ServiceAccount tokens have been enhanced and are now Generally Available. These tokens now embed a unique JTI (JWT ID) and the node identity of the pod from which they originate. This is like upgrading a standard ID card to a modern digital passport, which not only shows your photo but also includes a tamper-proof serial number and details of where it was issued. The practical implication is significant: token leakage becomes easier to detect and problematic tokens can be revoked with greater precision. Furthermore, admission controllers gain richer contextual information, enabling them to make more informed and granular policy decisions, thereby strengthening the overall security posture of the cluster.

Simplified Kubernetes Resource Interaction with Kubectl Subresource Support

Interacting with specific aspects of Kubernetes resources has become more straightforward. The –subresource flag is now fully and generally supported across common kubectl commands such as get, patch, edit, apply, and replace. Previously, managing subresources like status or scale often required more complex commands or direct YAML manipulation. This change is like having a single, intuitive universal remote that seamlessly controls every function of your entertainment system, eliminating the need for a confusing pile of separate remotes. For developers and operators, this means common actions on subresources are simpler and require less bespoke scripting.

Seamless network growth through dynamic service CIDR expansion

Addressing the needs of growing clusters, Kubernetes 1.33 introduces alpha support for the dynamic expansion of Service Classless Inter-Domain Routings (CIDRs). This allows administrators to add new IP address ranges for ClusterIP services by applying new ServiceCIDR objects. Imagine your home Wi-Fi network needing to accommodate a sudden influx of guests and their devices; this feature is like being able to effortlessly add more wireless channels or IP ranges without disrupting anyone already connected. For clusters that risk outgrowing their initial IP address pool, this provides a vital mechanism to scale network capacity without resorting to painful redeployments or risking IP address conflicts.

Stronger tenant isolation using user namespaces for pods

Enhancing security and isolation in multi-tenant environments, beta support for user namespaces in pods is a welcome addition. This feature enables the mapping of container User IDs (UIDs) and Group IDs (GIDs) to a distinct, unprivileged range on the host system. Consider an apartment building where each unit has its own completely separate utility meters and internal wiring, distinct from the building’s main infrastructure. A fault or surge in one apartment doesn’t affect the others. Similarly, user namespaces provide a stronger boundary, reducing the potential blast radius of privilege-escalation exploits by ensuring that even if a process breaks out of its container, it doesn’t gain root privileges on the underlying node.

Simplified tooling and configuration delivery via OCI image mounting

The delivery of tools, configurations, and other artifacts to pods is streamlined with the new alpha capability to mount Open Container Initiative (OCI) images and other OCI artifacts directly as read-only volumes. This is like being able to instantly snap a pre-packaged, specialized toolkit directly onto your workbench exactly when and where you need it, rather than having to unpack a large, cumbersome toolbox and sort through every individual item. This approach allows teams to share binaries, licenses, or even large language models without the need to bake them into base container images or uncompress tarballs at runtime, simplifying workflows and image management.

A more graceful departure with ordered namespace deletion

Managing the lifecycle of resources effectively includes ensuring their clean removal. Kubernetes 1.33 introduces an alpha implementation of a more structured, dependency-aware cleanup sequence when a namespace is deleted. Think of a professional stage crew dismantling a complex concert setup; they don’t just start pulling things down randomly. They follow a precise order, ensuring microphones are unplugged before speakers are moved, and lights are detached before rigging is lowered. This ordered deletion process helps prevent dangling resources, orphaned secrets, and other inconsistencies, contributing to a tidier, more secure, and more reliably managed cluster.

Looking ahead other highlights and farewell to old friends

While we’ve focused on some of the most prominent changes, the “Octarine” release encompasses 64 enhancements in total. Other notable improvements include updates to IPv6 NAT, better Container Runtime Interface (CRI) metrics, and faster kubectl get operations for extensive Custom Resource lists.

As Kubernetes evolves, some features are also retired to make way for more modern, secure, or scalable alternatives:

The Endpoints API is deprecated in favor of the more scalable EndpointSlice API.
The gitRepo volume type has been removed due to security concerns; users are encouraged to use Container Storage Interface (CSI) drivers or other methods for managing code.
hostNetwork support on Windows Pods is being retired due to inconsistencies and the availability of more robust alternative networking solutions.

This process is natural, much like replacing an aging, corded power drill with a more versatile and safer cordless model once superior technology becomes available.

Kubernetes continues its evolution for you

Kubernetes 1.33 “Octarine” clearly demonstrates the project’s ongoing commitment to addressing real-world challenges faced by developers and platform operators. From the operational flexibility of in-place scaling and the robust contract of GA sidecars to smarter batch job processing and thoughtful security reinforcements, these changes collectively pave the way for smoother operations, more resilient applications, and a more empowered development community.

Whether you are managing sprawling production clusters or experimenting in a modest homelab, adopting version 1.33 is less about chasing the newest version number and more about unlocking tangible, practical gains. These are the kinds of improvements that free you up to focus on innovation, ship features with greater confidence, and perhaps even sleep a little easier. The evolution of Kubernetes continues, and it’s a journey that consistently brings valuable enhancements to its vast community of users.

Kubernetes networking bottlenecks explained and resolved

Your Kubernetes cluster is humming along, orchestrating containers like a conductor leading an orchestra. Suddenly, the music falters. Applications lag, connections drop, and users complain. What happened? Often, the culprit hides within the cluster’s intricate communication network, causing frustrating bottlenecks. Just like a city’s traffic can grind to a halt, so too can the data flow within Kubernetes, impacting everything that relies on it.

This article is for you, the DevOps engineer, the cloud architect, the platform administrator, and anyone tasked with keeping Kubernetes clusters running smoothly. We’ll journey into the heart of Kubernetes networking, uncover the common causes of these slowdowns, and equip you with the knowledge to diagnose and resolve them effectively. Let’s turn that traffic jam back into a superhighway.

The unseen traffic control, Kubernetes networking, and CNI

At the core of every Kubernetes cluster’s communication lies the Container Network Interface, or CNI. Think of it as the sophisticated traffic management system for your digital city. It’s a crucial plugin responsible for assigning IP addresses to pods and managing how data packets navigate the complex connections between them. Without a well-functioning CNI, pods can’t talk, services become unreachable, and the system stutters.

Several CNI plugins act as different traffic control strategies:

Flannel: Often seen as a straightforward starting point, using overlay networks. Good for simpler setups, but can sometimes act like a narrow road during rush hour.
Calico: A more advanced option, known for high performance and robust network policy enforcement. Think of it as having dedicated express lanes and smart traffic signals.
Weave Net: A user-friendly choice for multi-host networking, though its ease of use might come with a bit more overhead, like adding extra toll booths.

Choosing the right CNI isn’t just a technical detail; it’s fundamental to your cluster’s health, depending on your needs for speed, complexity, and security.

Spotting the digital traffic jam, recognizing network bottlenecks

How do you know if your Kubernetes network is experiencing a slowdown? The signs are usually clear, though sometimes subtle:

Increased latency: Applications take noticeably longer to respond. Simple requests feel sluggish.
Reduced throughput: Data transfer speeds drop, even if your nodes seem to have plenty of CPU and memory.
Connection issues: You might see frequent timeouts, dropped connections, or intermittent failures for pods trying to communicate.

It feels like hitting an unexpected gridlock on what should be an open road. Even minor network hiccups can cascade, causing significant delays across your applications.

Unmasking the culprits, common causes for Bottlenecks

Network bottlenecks don’t appear out of thin air. They often stem from a few common culprits lurking within your cluster’s configuration or resources:

CNI Plugin performance limits: Some CNIs, especially simpler overlay-based ones like Flannel in certain configurations, have inherent throughput limitations. Pushing too much traffic through them is like forcing rush hour traffic onto a single-lane country road.
Node resource starvation: Packet processing requires CPU and memory on the worker nodes. If nodes are starved for these resources, the CNI can’t handle packets efficiently, much like an underpowered truck struggling to climb a steep hill.
Configuration glitches: Incorrect CNI settings, mismatched MTU (Maximum Transmission Unit) sizes between nodes and pods, or poorly configured routing rules can create significant inefficiencies. It’s like having traffic lights horribly out of sync, causing jams instead of flow.
Scalability hurdles: As your cluster grows, especially with high pod density per node, you might exhaust available IP addresses or simply overwhelm the network paths. This is akin to a city intersection completely gridlocked because far too many vehicles are trying to pass through simultaneously.

The investigation, diagnosing the problem systematically

Finding the exact cause requires a methodical approach, like a detective gathering clues at a crime scene. Don’t just guess; investigate:

Start with kubectl: This is your primary investigation tool. Examine pod statuses (kubectl get pods -o wide), check logs (kubectl logs <pod-name>), and test basic connectivity between pods (kubectl exec <pod-name> — ping <other-pod-ip>). Are pods running? Can they reach each other? Are there revealing error messages?
Deploy monitoring tools: You need visibility. Tools like Prometheus for metrics collection and Grafana for visualization are invaluable. They act as your network’s vital signs monitor.
Track key network metrics: Focus on the critical indicators:
- Latency: How long does communication take between pods, nodes, and external services?
- Packet loss: Are data packets getting dropped during transmission?
- Throughput: How much data is flowing through the network compared to expectations?
- Error rates: Are network interfaces reporting errors?

Analyzing these metrics helps pinpoint whether the issue is widespread or localized, related to specific nodes or applications. It’s like a mechanic testing different systems in a car to isolate the fault.

Paving the way for speed, proven solutions, and best practices

Once you’ve diagnosed the bottleneck, it’s time to implement solutions. Think of this as upgrading the city’s infrastructure to handle more traffic smoothly:

Choose the right CNI for the job: If your current CNI is hitting limits, consider migrating to a higher-performance option better suited for heavy workloads or complex network policies, such as Calico or Cilium. Evaluate based on benchmarks and your specific traffic patterns.
Optimize CNI configuration: Dive into the settings. Ensure the MTU is configured correctly across your infrastructure (nodes, pods, underlying network). Fine-tune routing configurations specific to your CNI (e.g., BGP peering with Calico). Small tweaks here can yield significant improvements.
Scale your infrastructure wisely: Sometimes, the nodes themselves are the bottleneck. Add more CPU or memory to existing nodes, or scale out by adding more nodes to distribute the load. Ensure your underlying network infrastructure can handle the increased traffic.
Tune overlay networks or go direct: If using overlay networks (like VXLAN used by Flannel or some Calico modes), ensure they are tuned correctly. For maximum performance, explore direct routing options where packets go directly between nodes without encapsulation, if supported by your CNI and infrastructure (e.g., Calico with BGP).

Success stories, from gridlock to open roads

The theory is good, but the results matter. Consider a team battling high latency in a densely packed cluster running Flannel. Diagnosis pointed to overlay network limitations. By migrating to Calico configured with BGP for more direct routing, they drastically cut latency and improved application responsiveness.

In another case, intermittent connectivity issues plagued a cluster during peak loads. Monitoring revealed CPU saturation on specific worker nodes handling heavy network traffic. Upgrading these nodes with more CPU resources immediately stabilized connectivity and boosted packet processing speeds. These examples show that targeted fixes, guided by proper diagnosis, deliver real performance gains.

Keeping the traffic flowing

Tackling Kubernetes networking bottlenecks isn’t just about fixing a technical problem; it’s about ensuring the reliability and scalability of the critical services your cluster hosts. A smooth, efficient network is the foundation upon which robust applications are built.

Just as a well-managed city anticipates and manages traffic flow, proactively monitoring and optimizing your Kubernetes network ensures your digital services remain responsive and ready to scale. Keep exploring, and keep learning, advanced CNI features and network policies offer even more avenues for optimization. Remember, a healthy Kubernetes network paves the way for digital innovation.

May 4, 2025 by Fernando SRE DevOps stuff Kubernetes SRE stuff 0

Why simplicity wins when you pick AWS ECS Fargate instead of EKS

Selecting the right tools often feels like navigating a crossroads. Consider planning a significant project, like building a custom home workshop. You could opt for a complex setup with specialized, industrial-grade machinery (powerful, flexible, demanding maintenance and expertise). Or, you might choose high-quality, standard power tools that handle 90% of your needs reliably and with far less fuss. Development teams deploying containers on AWS face a similar decision. The powerful, industry-standard Kubernetes via Elastic Kubernetes Service (EKS) beckons, but is it always the necessary path? Often, the streamlined native solution, Elastic Container Service (ECS) paired with its serverless Fargate launch type, offers a smarter, more efficient route.

AWS presents these two primary highways for container orchestration. EKS delivers managed Kubernetes, bringing its vast ecosystem and flexibility. It frequently dominates discussions and is hailed in the DevOps world. But then there’s ECS, AWS’s own mature and deeply integrated orchestrator. This article explores the compelling scenarios where choosing the apparent simplicity of ECS, particularly with Fargate, isn’t just easier; it’s strategically better.

Getting to know your AWS container tools

Before charting a course, let’s clarify what each service offers.

ECS (Elastic Container Service): Think of ECS as the well-designed, built-in toolkit that comes standard with your AWS environment. It’s AWS’s native container orchestrator, designed for seamless integration. ECS offers two ways to run your containers:

EC2 launch type: You manage the underlying EC2 virtual machine instances yourself. This gives you granular control over the instance type (perhaps you need specific GPUs or network configurations) but brings back the responsibility of patching, scaling, and managing those servers.
Fargate launch type: This is the serverless approach. You define your container needs, and Fargate runs them without you ever touching, or even seeing, the underlying server infrastructure.

Fargate: This is where serverless container execution truly shines. It’s like setting your high-end camera to an intelligent ‘auto’ mode. You focus on the shot (your application), and the camera (Fargate) expertly handles the complex interplay of aperture, shutter speed, and ISO (server provisioning, scaling, patching). You simply run containers.

EKS (Elastic Kubernetes Service): EKS is AWS’s managed offering for the Kubernetes platform. It’s akin to installing a professional-grade, multi-component software suite onto your operating system. It provides immense power, conforms to the Kubernetes standard loved by many, and grants access to its sprawling ecosystem of tools and extensions. However, even with AWS managing the control plane’s availability, you still need to understand and configure Kubernetes concepts, manage worker nodes (unless using Fargate with EKS, which adds its own considerations), and handle integrations.

The power of keeping things simple with ECS Fargate

So, what makes this simpler path with ECS Fargate so appealing? Several key advantages stand out.

Reduced operational overhead: This is often the most significant win. Consider the sheer liberation Fargate offers: it completely removes the burden of managing the underlying servers. Forget patching operating systems at 2 AM or figuring out complex scaling policies for your EC2 fleet. It’s the difference between owning a car, with all its maintenance chores, oil changes, tire rotations, and unexpected repairs, and using a seamless rental or subscription service where the vehicle is just there when you need it, ready to drive. You focus purely on the journey (your application), not the engine maintenance (the infrastructure).

Faster learning curve and easier management: ECS generally presents a gentler learning curve than the multifaceted world of Kubernetes. For teams already comfortable within the AWS ecosystem, ECS concepts feel intuitive and familiar. Managing task definitions, services, and clusters in ECS is often more straightforward than navigating Kubernetes deployments, services, pods, and the YAML complexities involved. This translates to faster onboarding and less time spent wrestling with the orchestrator itself. Furthermore, EKS carries an hourly cost for its control plane (though free tiers exist), an expense absent in the standard ECS setup.

Seamless AWS integration: ECS was born within AWS, and it shows. Its integration with other AWS services is typically tighter and simpler to configure than with EKS. Assigning IAM roles directly to ECS tasks for granular permissions, for instance, is remarkably straightforward compared to setting up Kubernetes Service Accounts and configuring IAM Roles for Service Accounts (IRSA) with an OIDC provider in EKS. Connecting to Application Load Balancers, registering targets, and pushing logs and metrics to CloudWatch often requires less configuration boilerplate with ECS/Fargate. It’s like your home’s electrical system being designed for standard plugs, appliances just work without needing special adapters or wiring.

True serverless container experience (Fargate): With Fargate, you pay for the vCPU and memory resources your containerized application requests, consumed only while it’s running. You aren’t paying for idle virtual machines waiting for work. This model is incredibly cost-effective for applications with variable loads, APIs that scale on demand, or batch jobs that run periodically.

Finding your route when ECS Fargate is the best fit

Knowing these advantages, let’s pinpoint the specific road signs indicating ECS/Fargate is the right direction for your team and application.

Teams prioritizing simplicity and velocity: If your primary goal is to ship features quickly and minimize the time spent on infrastructure management, ECS/Fargate is a strong contender. It allows developers to focus more on code and less on orchestration intricacies. It’s like choosing a reliable microwave and stove for everyday cooking; they get the job done efficiently without the complexity of a commercial kitchen setup.

Standard microservices or web applications: Many common workloads, like stateless web applications, APIs, or backend microservices, don’t require the advanced orchestration features or the specific tooling found only in the Kubernetes ecosystem. For these, ECS/Fargate provides robust, scalable, and reliable hosting without unnecessary complexity.

Deep reliance on the AWS ecosystem: If your application heavily leverages other AWS services (like DynamoDB, SQS, Lambda, RDS) and multi-cloud portability isn’t an immediate strategic requirement, ECS/Fargate’s native integration offers tangible benefits in ease of use and configuration.

Serverless-First architectures: For teams embracing a serverless mindset for event-driven processing, data pipelines, or API backends, Fargate fits perfectly. Its pay-per-use model and elimination of server management align directly with serverless principles.

Operational cost sensitivity: When evaluating the total cost of ownership, factor in the human effort. The reduced operational burden of ECS/Fargate can lead to significant savings in staff time and effort, potentially outweighing any differences in direct compute costs or the EKS control plane fee.

Acknowledging the alternative when EKS remains the champion

Of course, EKS exists for good reasons, and it remains the superior choice in certain contexts. Let’s be clear about when you need that powerful, customizable machinery.

Need for Kubernetes Standard/API: If your team requires the full Kubernetes API, needs specific Custom Resource Definitions (CRDs), operators, or advanced scheduling capabilities inherent to Kubernetes, EKS is the way to go.

Leveraging the vast Kubernetes ecosystem: Planning to use popular Kubernetes-native tools like Helm for packaging, Argo CD for GitOps, Istio or Linkerd for a service mesh, or specific monitoring agents designed for Kubernetes? EKS provides the standard platform these tools expect.

Existing Kubernetes expertise or workloads: If your team is already proficient in Kubernetes or you’re migrating existing Kubernetes applications to AWS, sticking with EKS leverages that investment and knowledge, ensuring consistency.

Hybrid or Multi-Cloud strategy: When running workloads across different cloud providers or in hybrid on-premises/cloud environments, Kubernetes (and thus EKS on AWS) provides a consistent orchestration layer, crucial for portability and operational uniformity.

Highly complex orchestration needs: For applications demanding intricate network policies (e.g., using Calico), complex stateful set management, or very specific affinity/anti-affinity rules that might be more mature or flexible in Kubernetes, EKS offers greater depth.

Think of EKS as that specialized, heavy-duty truck. It’s indispensable when you need to haul unique, heavy loads (complex apps), attach specialized equipment (ecosystem tools), modify the engine extensively (custom controllers), or drive consistently across varied terrains (multi-cloud).

Choosing your lane ECS Fargate or EKS

The key insight here isn’t about crowning one service as universally “better.” It’s about recognizing that the AWS container landscape offers different tools meticulously designed for different journeys. ECS with Fargate stands as a powerful, mature, and often much simpler alternative, decisively challenging the notion that Kubernetes via EKS should be the default starting point for every containerized application on AWS.

Before committing, honestly assess your application’s real complexity, your team’s operational capacity, and existing expertise, your reliance on the broader AWS vs. Kubernetes ecosystems, and your strategic goals regarding portability. It’s like packing for a trip: you wouldn’t haul mountaineering equipment for a relaxing beach holiday. Choose the toolset that minimizes friction, maximizes your team’s velocity, and keeps your journey smooth. Choose wisely.

April 28, 2025 by Fernando SRE Cloud stuff DevOps stuff Kubernetes SRE stuff 0

Unified hybrid cloud governance with AWS Control Tower & Terraform Cloud

For many organizations today, working effectively means adopting a blend of cloud environments. Hybrid and multi-cloud strategies offer flexibility, resilience, and cost savings by allowing businesses to pick the best services from different providers and avoid being locked into one vendor. It sounds great on paper, but this freedom introduces a significant headache: governance. Trying to manage configurations, enforce security rules, and maintain compliance across different platforms, each with its own set of tools and controls, can feel like cooking a coordinated meal in several kitchens, each with entirely different layouts and rulebooks. The result? Often chaos, inconsistencies, security blind spots, and wasted effort.

But what if you could bring order to this complexity? What if there was a way to establish a coherent set of rules and automated checks across your hybrid landscape? This is where the powerful combination of AWS Control Tower and Terraform Cloud steps in, offering a unified approach to tame the hybrid beast. Let’s explore how these tools work together to streamline governance and empower your organization.

The growing maze of hybrid cloud governance

Using multiple clouds and on-premises data centers makes sense for optimizing costs and accessing specialized services. However, managing this distributed setup is tough. Each cloud provider (AWS, Azure, GCP) and your own data center operate differently. Without a unified strategy, teams constantly juggle various dashboards and workflows. It’s easy for configurations to drift apart, security policies to become inconsistent, and compliance gaps to appear unnoticed.

This fragmentation isn’t just inefficient; it’s risky. Misconfigurations can lead to security vulnerabilities or service outages. Keeping everything aligned manually is a constant battle. What’s needed is a central command center, a unified governance plane providing clear visibility, consistent control, and automation across the entire hybrid infrastructure.

Why is unified governance key?

Adopting a unified governance approach brings tangible benefits:

Speed up account setup: AWS Control Tower automates the creation of secure, compliant AWS accounts based on your predefined blueprints (landing zones). Think of it like having pre-approved building plans; you can construct new, safe environments quickly without lengthy reviews each time.
Built-in safety nets: Control Tower comes with pre-configured “guardrails.” These are like safety railings on a staircase, preventive ones stop you from taking a dangerous step (non-compliant actions), while detective ones alert you if something is already out of place. This ensures your AWS environment adheres to best practices from the start.
Consistent rules everywhere: Terraform Cloud extends this idea beyond AWS. Using tools like Sentinel or Open Policy Agent (OPA), you can write governance rules (like “no public S3 buckets” or “only approved VM sizes”) once and automatically enforce them across all your cloud environments managed by Terraform. It ensures everyone follows the same playbook, regardless of the kitchen they’re cooking in.

Combining these capabilities creates a governance framework that is both robust and adaptable to the complexities of hybrid setups.

Laying the AWS foundation with Control Tower

AWS Control Tower establishes a well-architected multi-account environment within AWS, known as a landing zone. This provides a solid, governed foundation. Key components include:

Organizational Units (OUs): Grouping accounts logically (e.g., by department or environment) to apply specific policies.
Guardrails: As mentioned, these are crucial for enforcing compliance. You can even set up automated fixes for issues detected by detective guardrails, reducing manual intervention.
Account Factory for Terraform (AFT): While Control Tower provides standard account blueprints, AFT lets you customize these using Terraform. This is invaluable for hybrid scenarios, allowing you to automatically bake in configurations like VPN connections or AWS Direct Connect links back to your on-premises network during account creation.

Control Tower provides the structure and rules for your AWS estate, ensuring consistency and security.

Extending governance across clouds with Terraform Cloud

While Control Tower governs AWS effectively, Terraform Cloud acts as the bridge to manage and govern your entire hybrid infrastructure, including other clouds and on-premises resources.

Teamwork made easy: Terraform Cloud provides features like shared state management (so everyone knows the current infrastructure status), access controls, and integration with version control systems (like Git). This allows teams to collaborate safely on infrastructure changes.
Policy as Code across clouds: This is where the real magic happens for hybrid governance. Using Sentinel or OPA within Terraform Cloud, you define policies that check infrastructure code before it’s applied, ensuring compliance across AWS, Azure, GCP, or anywhere else Terraform operates.
Keeping secrets safe: Securely managing API keys, passwords, and other sensitive data is critical. Terraform Cloud offers encrypted storage and mechanisms for securely injecting credentials when needed.

By integrating Terraform Cloud with AWS Control Tower, you gain a unified workflow to deploy, manage, and govern resources consistently across your entire hybrid landscape.

Smart habits for hybrid control

To get the most out of this unified approach, adopt these best practices:

Define, don’t improvise (Idempotency): Use Terraform’s declarative nature to define your desired infrastructure state. This ensures applying the configuration multiple times yields the same result (idempotency). Regularly check for “drift”, differences between your code and the actual deployed infrastructure, and reconcile it.
Manage changes through code (GitOps): Treat your infrastructure configuration like application code. Use Git for version control and pull requests for proposing and reviewing changes. Automate checks within Terraform Cloud as part of this process.
See everything in one place (Monitoring): Integrate monitoring tools like AWS CloudWatch with notifications from Terraform Cloud runs. This helps create a centralized view of deployments, changes, and compliance status across all environments.

Putting it all together

Let’s see how this works practically. Imagine your team needs a new AWS account that must securely connect to your company’s private data center.

Define the space (Control Tower OU): Create a new Organizational Unit in AWS Control Tower for this purpose, applying standard security and network guardrails.
Build the account (AFT): Use Account Factory for Terraform (AFT) to provision the new AWS account. Customize the AFT template to automatically include the necessary configurations for a VPN or Direct Connect gateway based on your company standards.
Deploy resources (Terraform Cloud): Once the governed account exists, trigger a Terraform Cloud run. This run, governed by your Sentinel/OPA policies, deploys specific resources within the account, perhaps setting up DNS resolvers to securely connect back to your on-premises network.

This streamlined workflow ensures the new account is provisioned quickly, securely, adheres to company policies, and has the required hybrid connectivity built-in from the start.

The future of governance

The world of hybrid and multi-cloud is constantly evolving, with new tools emerging. However, the fundamental need for simple, secure, and automated governance remains constant.

By combining the strengths of AWS Control Tower for foundational AWS governance and Terraform Cloud for multi-cloud automation and policy enforcement, organizations can confidently manage their complex hybrid environments. This unified approach transforms a potential management nightmare into a well-orchestrated, resilient, and compliant infrastructure ready for whatever comes next. It’s about building a system that is not just powerful and flexible, but also fundamentally manageable.

April 24, 2025 by Fernando SRE Cloud stuff DevOps stuff SRE stuff 0

The essentials of Cloud Native software development

Cloud native development is not just about moving applications to the cloud. It represents a shift in how software is designed, built, deployed, and operated. It enables systems to be more scalable, resilient, and adaptable to change, offering a competitive edge in a fast-evolving digital landscape.

This approach embraces the core principles of modern software engineering, making full use of the cloud’s dynamic nature. At its heart, cloud-native development combines containers, microservices, continuous delivery, and automated infrastructure management. The result is a system that is not only robust and responsive but also efficient and cost-effective.

Understanding the Cloud Native foundation

Cloud native applications are designed to run in the cloud from the ground up. They are built using microservices: small, independent components that perform specific functions and communicate through well-defined APIs. These components are packaged in containers, which make them portable across environments and consistent in behavior.

Unlike traditional monoliths, which can be rigid and hard to scale, microservices allow teams to build, test, and deploy independently. This improves agility, fault tolerance, and time to market.

Containers bring consistency and portability

Containers are lightweight units that package software along with its dependencies. They help developers avoid the classic “it works on my machine” problem, by ensuring that software runs the same way in development, testing, and production environments.

Tools like Docker and Podman, along with orchestration platforms like Kubernetes, have made container management scalable and repeatable. While Docker remains a popular choice, Podman is gaining traction for its daemonless architecture and enhanced security model, making it a compelling alternative for production environments. Kubernetes, for example, can automatically restart failed containers, balance traffic, and scale up services as demand grows.

Microservices enhance flexibility

Splitting an application into smaller services allows organizations to use different languages, frameworks, and teams for each component. This modularity leads to better scalability and more focused development.

Each microservice can evolve independently, deploy at its own pace, and scale based on specific usage patterns. This means resources are used more efficiently and updates can be rolled out with minimal risk.

Scalability meets demand dynamically

Cloud native systems are built to scale on demand. When user traffic increases, new instances of a service can spin up automatically. When demand drops, those resources can be released.

This elasticity reduces costs while maintaining performance. It also enables companies to handle unpredictable traffic spikes without overprovisioning infrastructure. Tools and services such as Auto Scaling Groups (ASG) in AWS, Virtual Machine Scale Sets (VMSS) in Azure, Horizontal Pod Autoscalers in Kubernetes, and Google Cloud’s Managed Instance Groups play a central role in enabling this dynamic scaling. They monitor resource usage and adjust capacity in real time, ensuring applications remain responsive while optimizing cost.

Automation and declarative APIs drive efficiency

One of the defining features of cloud native development is automation. With infrastructure as code and declarative APIs, teams can provision entire environments with a few lines of configuration.

These tools, such as Terraform, Pulumi, AWS CloudFormation, Azure Resource Manager (ARM) templates, and Google Cloud Deployment Manager, Google Cloud Deployment Manager, reduce manual intervention, prevent configuration drift, and make environments reproducible. They also enable continuous integration and continuous delivery (CI/CD), where new features and bug fixes are delivered faster and more reliably.

Advantages that go beyond technology

Adopting a cloud native approach brings organizational benefits as well:

Faster Time to Market: Teams can release features quickly thanks to independent deployments and automation.
Lower Operational Costs: Elastic infrastructure means you only pay for what you use.
Improved Reliability: Systems are designed to be resilient to failure and easy to recover.
Cross-Platform Portability: Containers allow applications to run anywhere with minimal changes.

A simple example with Kubernetes and Docker

Let’s say your team is building an online bookstore. Instead of creating a single large application, you break it into services: one for handling users, another for managing books, one for orders, and another for payments. Each of these runs in a separate container.

You deploy these containers using Kubernetes. When many users are browsing books, Kubernetes can automatically scale up the books service. If the orders service crashes, it is automatically restarted. And when traffic is low at night, unused services scale down, saving costs.

This modular, automated setup is the essence of cloud native development. It lets teams focus on delivering value, rather than managing infrastructure.

Cloud Native success

Cloud native is not a silver bullet, but it is a powerful model for building modern applications. It demands a cultural shift as much as a technological one. Teams must embrace continuous learning, collaboration, and automation.

Organizations that do so gain a significant edge, building software that is not only faster and cheaper, but also ready to adapt to the future.

If your team is beginning its journey toward cloud native, start small, experiment, and iterate. The cloud rewards those who learn quickly and adapt with confidence.

April 21, 2025 by Fernando SRE Cloud stuff DevOps stuff SRE stuff 0

How real-time data transforms Architecture and DevOps

You know, for a long time, Enterprise Architecture, or EA, felt a bit like map-making after the explorers had already come back. People drew intricate diagrams of how things were or how they should be, often locked away in tools only a few knew how to use. It was important work, sure, but sometimes it felt disconnected from the fast-paced world of building and running software, especially in the cloud and DevOps realms where things change by the minute.

But something interesting has been happening. EA is shedding its old skin. It’s moving away from being a static blueprint repository and becoming more like a dynamic, living navigation system for the business. And the fuel for this new system? Data. Lots of it. This shift makes EA incredibly relevant and much more exciting for those of us knee-deep in DevOps, SRE, and Cloud Architecture. Let’s explore how this data-driven approach isn’t just a new coat of paint for EA but a powerful engine for building and operating systems today.

Real-time data is king, so no more stale maps

Think about driving using a paper map printed last year versus using a live GPS app. Which one do you trust when navigating rush hour traffic? It’s the same with system architecture. Decisions based on diagrams updated manually months ago, or worse, on someone’s gut feeling, just don’t cut it anymore.

The new approach insists on using live data. This means tapping directly into the sources of truth through APIs and integrations. We’re talking about pulling information from your cloud provider, your monitoring systems (think Prometheus, Datadog, Dynatrace), your CI/CD pipelines, your configuration management databases (CMDBs), and even your code repositories.

Why is this such a big deal for DevOps and Cloud folks? Because it mirrors exactly what we strive for with observability. We need real-time insights into system health, performance, and dependencies to operate effectively. When EA leverages the same live data streams, it stops being a theoretical exercise and starts reflecting the actual, breathing state of our complex, distributed systems. Imagine architectural diagrams that automatically update when a new service is deployed via your pipeline or that highlight dependencies based on real network traffic observed by your monitoring tools. That’s moving from a stale map to a live GPS.

Turning data noise into strategic signals

Okay, so we hook everything up and get data flowing. Great! But now we risk drowning in it. A flood of metrics and logs isn’t useful on its own; it can just be noise. The real magic happens when we turn that raw data into insights and those insights into action.

This is where smart visualizations and context-aware dashboards come into play. Instead of presenting architects or DevOps teams with a giant spreadsheet of everything, the idea is to show the right information to the right people at the right time. Think dashboards tailored to specific business capabilities, showing not just CPU usage but how application performance impacts user experience or conversion rates. Or tools that use algorithms to automatically detect anomalies or predict potential bottlenecks based on current trends.

There’s even a fascinating concept emerging called a “Digital Twin of an Organization” or DTO. Don’t let the fancy name scare you. Think of it as a sophisticated simulation or model of your systems and processes built on real data. It allows you to ask “what if” questions. What happens if we migrate this database? What’s the impact of doubling traffic to this service? It’s like having a virtual sandbox, informed by reality, to test changes and understand complex interdependencies before touching production. For SREs and architects managing intricate cloud environments, being able to model changes and predict outcomes is incredibly powerful – it helps us navigate complexity and reduce risk.

The automation and AI advantage freeing up brainpower

Now, collecting all this data, analyzing it, and keeping models updated sounds like a ton of work. And it would be if done manually. This is where automation becomes essential.

Much like we use Infrastructure as Code (IaC) tools (like Terraform or Pulumi) to automate infrastructure provisioning or CI/CD pipelines to automate testing and deployment, modern EA relies heavily on automation. Automating data collection from various sources is just the start. We can automate the generation of visualizations, the detection of architectural drift (when the reality no longer matches the intended design), and even basic consistency checks against predefined architectural principles or security standards.

And Artificial Intelligence (AI) is starting to play a role too. AI can help make sense of unstructured data (like text in design documents), identify complex patterns in operational data that humans might miss (hello, AIOps!), and even suggest improvements or refactoring options for system designs.

The goal here isn’t to replace architects or engineers. It’s the same goal as in DevOps automation: to handle the repetitive, time-consuming, and error-prone tasks so that humans can focus their valuable brainpower on the more strategic, creative, and complex challenges. It frees people up to think about higher-level design, innovation, and solving tricky business problems.

Why this matters to you

So, why should you, as a DevOps engineer, SRE, or Cloud Architect, care about these shifts in EA?

Because this data-driven, automated approach bridges the gap that often existed between architecture and operations.

Faster, Better Decisions: When architecture is based on the same live data you use for monitoring and troubleshooting, decisions about scaling, resilience, or refactoring become much more informed and timely.
Reduced Friction: It breaks down silos. Architects understand the operational reality better, and Ops/Dev teams get clearer guidance rooted in that reality. Collaboration improves naturally.
Proactive Problem Solving: By analyzing trends and modeling changes (like with a DTO), you can move from reactive firefighting to proactively identifying and mitigating risks or performance issues.
Improved Alignment: It helps ensure that the systems we build and run are truly aligned with business goals, using metrics that matter to the business, not just technical metrics.
Efficiency: Automation handles the grunt work, letting you focus on more interesting and impactful problems.

Essentially, this evolution of EA makes the architect’s work more grounded, more dynamic, and more directly supportive of the goals we pursue in DevOps and Cloud environments – building resilient, scalable, and efficient systems that deliver value quickly.

Embracing a smarter architecture

The world of Enterprise Architecture is changing. It’s becoming less about static drawings and rigid governance and more about leveraging real-time data, insightful analytics, and smart automation. It’s becoming a living, breathing part of the technology ecosystem.

For those of us working in DevOps and the Cloud, this is fantastic news. It means EA is speaking our language, using the data we rely on, and adopting the automation principles we champion. It’s becoming a powerful ally in our quest to build and operate better systems. Letting data steer the ship isn’t just a new rule for architects; it’s a smarter way for all of us to navigate the complexities of modern technology.

April 4, 2025 by Fernando SRE Cloud stuff Computer Science stuff DevOps stuff SRE stuff 0

What are cloud operating systems?

You know your computer, right? That trusty machine, maybe running Windows, macOS, or perhaps a flavor of Linux like my buddy Fernando rocks with his Ubuntu setup. It has an Operating System. Its job? To manage the guts of that one machine, the processor, the memory, the storage, making sure your apps can run, your files are saved. It’s the conductor of a small, personal orchestra.

Now… zoom out. Way out.

Imagine not one computer but thousands. Tens of thousands. Maybe millions. Housed in colossal buildings we call data centers, spread across the globe, all interconnected. A sprawling, humming galaxy of computation.

How do you manage that? You can’t just install Windows on the entire internet! That’s like trying to run a city using the rules of a single household. It just doesn’t scale.

Meet the Cloud Operating System.

Now, hold on, don’t picture a single piece of software called “CloudOS” that you download. It’s more fundamental, more… cosmic in its scope. Think of it less as the OS on a single server in the cloud (that’s often still Linux or Windows), and more like the overarching intelligence, the distributed brain managing the entire fleet, the whole data center, maybe even multiple data centers as one cohesive entity.

What does this cosmic brain do? It performs a symphony of coordination on a scale that would make your desktop OS blush:

It Abstracts the Hardware: It takes all those individual servers, storage racks, networking gear, the raw physical stuff, and throws a kind of “invisibility cloak” over it. It presents it all as a unified, seemingly infinite pool of resources. You ask for processing power, memory, storage, and the Cloud OS figures out where in that vast physical infrastructure to get it from, without you needing to know or care about the specific box. It’s like asking for “water” and the system handles whether it comes from this reservoir or that aquifer.
It Orchestrates Resources: Need to spin up a thousand virtual servers for a massive calculation? Boom. The Cloud OS handles the provisioning, allocation, and networking. Need to automatically scale your website’s capacity because you just went viral? The Cloud OS is the maestro making that happen seamlessly. It’s the ultimate traffic controller, resource allocator, and taskmaster for the entire digital city.
It Manages Virtualization: This is key. Cloud OSes are masters of virtualization, carving up physical machines into multiple virtual ones (VMs) or pooling resources to make many machines act as one giant one. It’s about turning rigid hardware into a flexible, fluid resource.
It Provides Essential Services: Think scheduling (what runs where and when), storage management (replicating data for safety, moving it for speed), network management (directing traffic flow), fault tolerance (if one server fails, the system barely notices), and massive automation (because no army of humans could manage this manually).

So, can you point to one specific “Cloud Operating System”? Well, it’s complicated. The giants, Amazon AWS, Microsoft Azure, and Google Cloud Platform, have built their own incredibly sophisticated, largely proprietary systems that act as the planet-scale operating systems for their clouds. Projects like OpenStack aim to provide an open-source framework to build this kind of cloud management system. And technologies like Kubernetes, while often called a “container orchestrator,” are essentially performing many of the distributed operating system functions at the application layer within the cloud.

Why is this disruptive? Because it fundamentally broke the old model of computing. We went from being limited by the box on our desk to tapping into near-limitless resources on demand. The Cloud OS is the unsung hero behind this revolution, the invisible intelligence weaving together the fabric of the modern digital world. It’s not just managing silicon and wires; it’s managing possibility on an unprecedented scale.

Think about that the next time you access a file from anywhere or watch a video streamed from the ether. You’re witnessing the silent, elegant dance orchestrated by a Cloud Operating System.

Hope that expands your view of the computational cosmos! Keep looking up… and into the cloud.

March 30, 2025 by Fernando SRE Cloud stuff Computer Science stuff 0

Understanding AWS Lambda Extensions beyond the hype

Lambda extensions are fascinating little tools. They’re like straightforward add-ons, but they bring their own set of challenges. Let’s explore what they are, how they work, and the realities behind using them in production.

Lambda extensions enhance AWS Lambda functions without changing your original application code. They’re essentially plug-and-play modules, which let your functions communicate better with external tools like monitoring, observability, security, and governance services.

Typically, extensions help you:

Retrieve configuration data or secrets securely.
Send logs and performance data to external monitoring services.
Track system-level metrics such as CPU and memory usage.

That sounds quite useful, but let’s look deeper at some hidden complexities.

The hidden risks of Lambda Extensions

Lambda extensions seem simple, but they do add potential risks. Three main areas to watch carefully are security, developer experience, and performance.

Security Concerns

Extensions can be helpful, but they’re essentially third-party software inside your AWS environment. You’re often not entirely sure what’s happening within these extensions since they work somewhat like black boxes. If the publisher’s account is compromised, malicious code could be silently deployed, potentially accessing your sensitive resources even before your security tools detect the problem.

In other words, extensions require vigilant security practices.

Developer experience isn’t always a walk in the park

Lambda extensions can sometimes make life harder for developers. Local testing, for instance, isn’t always straightforward due to external dependencies extensions may have. This discrepancy can result in surprises during deployment, and errors that show up only in production but not locally.

Additionally, updating extensions isn’t always seamless. Extensions use Lambda layers, which aren’t managed through a convenient package manager. You need to track and manually apply updates, complicating your workflow. On top of that, layers count towards Lambda’s total deployment size, capped at 250 MB, adding another layer of complexity.

Performance and cost considerations

Extensions do not come without cost. They consume CPU, memory, and storage resources, which can increase the duration and overall cost of your Lambda functions. Additionally, extensions may slightly slow down your function’s initial execution (cold start), particularly if they require considerable initialization.

When to actually use Lambda Extensions

Lambda extensions have their place, but they’re not universally beneficial. Let’s break down common scenarios:

Fetching configurations and secrets

Extensions initially retrieve configurations quickly. However, once data is cached, their advantage largely disappears. Unless you’re fetching a high volume of secrets frequently, the complexity isn’t likely justified.

Sending logs to external services

Using extensions to push logs to observability platforms is practical and efficient for many use cases. But at a large scale, it may be simpler, and often safer, to log centrally via AWS CloudWatch and forward logs from there.

Monitoring container metrics

Using extensions for monitoring container-level metrics (CPU, memory, disk usage) is highly beneficial. While ideally integrated directly by AWS, for now, extensions fulfill this role exceptionally well.

Chaos engineering experiments

Extensions shine particularly in chaos engineering scenarios. They let you inject controlled disruptions easily. You simply add them during testing phases and remove them afterward without altering your main Lambda codebase. It’s efficient, low-risk, and clean.

The power and practicality of Lambda Extensions

Lambda extensions can significantly boost your Lambda functions’ abilities, enabling advanced integrations effortlessly. However, it’s essential to weigh the added complexity, potential security risks, and extra costs against these benefits. Often, simpler approaches, like built-in AWS services or standard open-source libraries, offer a smoother path with fewer headaches.
Carefully consider your real-world requirements, team skills, and operational constraints. Sometimes the simplest solution truly is the best one.
Ultimately, Lambda extensions are powerful, but only when used wisely.

March 19, 2025 by Fernando SRE Cloud stuff DevOps stuff 0

Serverless mistakes that can ruin your architecture

Serverless architectures offer a compelling promise. They focus on business logic, not infrastructure. They scale automatically, simplify management, and can significantly reduce operational overhead. But over the years, as serverless technology evolved, certain initially appealing patterns revealed hidden pitfalls. Through my journey of building and refining serverless systems, I’ve uncovered a handful of common patterns you should reconsider or abandon altogether. Let’s explore these in detail to help you steer clear of similar mistakes.

Direct API Gateway integrations aren’t always better

Connecting API Gateway directly to services like DynamoDB or SQS, bypassing Lambda functions, initially sounds smart. It promises lower latency, less complexity, and reduced costs by eliminating the Lambda middleman. Who wouldn’t want quicker responses at lower costs?

However, this pattern quickly turns from friend to foe. Defining integration mappings is cumbersome and error-prone, and you lose the flexibility provided by Lambda. Complex mappings become challenging to test, troubleshoot, and maintain, especially when your requirements evolve. When something goes wrong, debugging can be painstaking because you lack detailed logging typically provided by Lambda.

Moreover, security and authorization quickly become complicated. Simple IAM-based authorization often proves insufficient, forcing you to revert to Lambda authorizers. Ultimately, what seemed like efficiency turns into a roadblock.

If your scenario truly is static, limited, and straightforward, a direct integration might work fine. But rarely does reality remain simple for long.

Monolithic Lambda Functions

Many developers, including me, started by creating monolithic Lambda functions that handle numerous API routes. It seemed practical, one deployment, easy management, and straightforward development experience, similar to using frameworks like FastAPI or Express. But as I learned, simplicity can mask significant drawbacks.

Here’s why monolithic Lambdas cause trouble:

Costly Resource Allocation: If a single API route requires more memory or CPU, every route inherits these increased resources. You end up paying more for all functions unnecessarily.
Security Risks: Broad permissions are needed, breaking AWS’s best practice of least privilege.
Scaling Issues: All paths scale equally, leading to inefficiencies when only specific paths experience heavy traffic.
Deployment Risks: An error or misconfiguration affects the entire service rather than just a single endpoint.

Breaking the giant Lambda into smaller, specialized micro-functions per API path provides precise control over scalability, security, cost, and memory usage. Each function’s settings can be tuned precisely, reducing costs and improving reliability. The micro-function approach may increase initial complexity slightly, but the long-term benefits greatly outweigh these costs.

Direct Lambda-to-Lambda invocations

Initially, invoking Lambda functions directly from other Lambdas via AWS SDK felt natural. I did it myself thinking it simplified communication between closely related tasks. However, experience showed me this pattern brings more headaches than benefits.

Here’s why:

Tight Coupling: Any change in the invoked Lambda’s name or deployment causes immediate breakage. That’s a fragile system.
Idle Waiting: In synchronous invocations, you pay for wasted compute time as one Lambda waits for another.
Complexity: Direct invocations bypass beneficial abstraction layers, making refactoring difficult.

Instead, adopt an event-driven approach using EventBridge or API Gateway. These intermediaries create loose coupling, facilitating easier scaling, error handling, and maintenance.

Putting everything inside the Handler

At first, writing all the code directly in the Lambda handler seems simpler, one file, fewer headaches. Unfortunately, simplicity fades quickly with complexity, leading to bloated handlers difficult to test, maintain, and debug.

Instead, structure your code logically:

Handler Layer: Initialization, input validation, error catching.
Business Logic Layer: Application-specific logic isolated from configuration and I/O concerns.
Data Access Layer (DAL): Abstracts interactions with databases or external services.

This architectural clarity dramatically simplifies unit testing, debugging, and refactoring. When changes inevitably come, you’ll thank yourself for not cutting corners.

Using EventBridge rules for scheduled tasks

AWS provides two methods for scheduling tasks through EventBridge, Rules and the newer Scheduler. Initially, Rules seemed convenient, especially because AWS never officially deprecated them. But sticking to rules can now be considered a missed opportunity.

Why prefer Scheduler over Rules?

Better Feature Set: Scheduler includes improved capabilities like one-time schedules, fine-grained control, and more intuitive management.
Scalability: Easier management at large scale.
Cost Optimization: Improved efficiency can lead to noticeable cost savings.

Simply put, adopting the newer EventBridge Scheduler positions your infrastructure to be future-proof.

Ignoring observability from the start

Early in my serverless journey, I underestimated observability. Logging seemed enough until it wasn’t. Observability isn’t just about logging errors; it’s about understanding your system thoroughly, from performance bottlenecks to tracing execution across multiple services.

Modern observability tools like AWS X-Ray, OpenTelemetry, and CloudWatch Logs Insights provide invaluable insight into your application’s behavior, especially in serverless environments where traditional debugging is less straightforward.

Integrating observability from day one may seem like overhead, but it significantly shortens troubleshooting and reduces downtime in production.

Final thoughts

Serverless architectures are transformative, but only when applied thoughtfully. The lessons shared here come from real-world experiences and occasional painful mistakes. By reflecting on these patterns and adapting your practices accordingly, you’ll save yourself future headaches and set your projects on a path toward greater flexibility, reliability, and maintainability. Remember, good architecture evolves through both wisdom and the humility to recognize and correct past mistakes.

March 15, 2025 by Fernando SRE Cloud stuff DevOps stuff 0

AWS Disaster Recovery simplified for every business

Let’s talk about something really important, even if it’s not always the most glamorous topic: keeping your AWS-based applications running, no matter what. We’re going to explore the world of High Availability (HA) and Disaster Recovery (DR). Think of it as building a castle strong enough to withstand a dragon attack, or, you know, a server outage..

Why all the fuss about Disaster Recovery?

Businesses run on applications. These are the engines that power everything from online shopping to, well, pretty much anything digital. If those engines sputter and die, bad things happen. Money gets lost. Customers get frustrated. Reputations get tarnished. High Availability and Disaster Recovery are all about making sure those engines keep running, even when things go wrong. It’s about resilience.

Before we jump into solutions, we need to understand two key measurements:

Recovery Time Objective (RTO): How long can you afford to be down? Minutes? Hours? Days? This is your RTO.
Recovery Point Objective (RPO): How much data can you afford to lose? The last hour’s worth? The last days? That’s your RPO.

Think of RTO and RPO as your “pain tolerance” levels. A low RTO and RPO mean you need things back up and running fast, with minimal data loss. A higher RTO and RPO mean you can tolerate a bit more downtime and data loss. The correct option will depend on your business needs.

Disaster recovery strategies on AWS, from basic to bulletproof

AWS offers a toolbox of options, from simple backups to fully redundant, multi-region setups. Let’s explore a few common strategies, like choosing the right level of armor for your knight:

Pilot Light: Imagine keeping the pilot light lit on your stove. It’s not doing much, but it’s ready to ignite the main burner at any moment. In AWS terms, this means having the bare minimum running, maybe a database replica syncing data in another region, and your server configurations saved as templates (AMIs). When disaster strikes, you “turn on the gas”, launch those servers, connect them to the database, and you’re back in business.
- Good for: Cost-conscious applications where you can tolerate a few hours of downtime.
- AWS Services: RDS Multi-AZ (for database replication), Amazon S3 cross-region replication, EC2 AMIs.
Warm Standby: This is like having a smaller, backup stove already plugged in and warmed up. It’s not as powerful as your main stove, but it can handle the basic cooking while the main one is being repaired. In AWS, you’d have a scaled-down version of your application running in another region. It’s ready to handle traffic, but you might need to scale it up (add more “burners”) to handle the full load.
- Good for: Applications where you need faster recovery than Pilot Light, but you still want to control costs.
- AWS Services: Auto Scaling (to automatically adjust capacity), Amazon EC2, Amazon RDS.
Active/Active (Multi-Region): This is the “two full kitchens” approach. You have identical setups running in multiple AWS regions simultaneously. If one kitchen goes down, the other one is already cooking, and your customers barely notice a thing. You use AWS Route 53 (think of it as a smart traffic controller) to send users to the closest or healthiest “kitchen.”
- Good for: Mission-critical applications where downtime is simply unacceptable.
- AWS Services: Route 53 (with health checks and failover routing), Amazon EC2, Amazon RDS, DynamoDB global tables.

Picking the right armor, It’s all about trade-offs

There’s no “one-size-fits-all” answer. The best strategy depends on those RTO/RPO targets we talked about, and, of course, your budget.

Here’s a simple way to think about it:

Tight RTO/RPO, Budget No Object? Active/Active is your champion.
Need Fast Recovery, But Watching Costs? Warm Standby is a good compromise.
Can Tolerate Some Downtime, Prioritizing Cost Savings? Pilot Light is your friend.
Minimum RTO/RPO and Minimum Budget? Backups.

The trick is to be honest about your real needs. Don’t build a fortress if a sturdy wall will do.

A quick glimpse at implementation

Let’s say you’re going with the Pilot Light approach. You could:

Set up Amazon S3 Cross-Region Replication to copy your important data to another AWS region.
Create an Amazon Machine Image (AMI) of your application server. This is like a snapshot of your server’s configuration.
Store that AMI in the backup region.

In a disaster scenario, you’d launch EC2 instances from that AMI, connect them to your replicated data, and point your DNS to the new instances.

Tools like AWS Elastic Disaster Recovery (a managed service) or CloudFormation (for infrastructure-as-code) can automate much of this process, making it less of a headache.

Testing, Testing, 1, 2, 3…

You wouldn’t buy a car without a test drive, right? The same goes for disaster recovery. You must test your plan regularly.

Simulate a failure. Shut down resources in your primary region. See how long it takes to recover. Use AWS CloudWatch metrics to measure your actual RTO and RPO. This is how you find the weak spots before a real disaster hits. It’s like fire drills for your application.

The takeaway, be prepared, not scared

Disaster recovery might seem daunting, but it doesn’t have to be. AWS provides the tools, and with a bit of planning and testing, you can build a resilient architecture that can weather the storm. It’s about peace of mind, knowing that your business can keep running, no matter what. Start small, test often, and build up your defenses over time.

March 13, 2025 by Fernando SRE Cloud stuff DevOps stuff 0