/writing
Writing
Notes from things I've actually run in production. Mostly the parts that were harder than the documentation implied.
MSK multi-region connectivity, IAM, and knowing when to stop
Enabling IAM and SASL multi-VPC connectivity for managed Kafka was the easy part. The managed cross-region replication POC taught more by being removed.
Scaling Kafka consumers on KEDA with IAM authentication
Consumer lag is the only autoscaling signal that means anything for a Kafka consumer. Getting KEDA to read it when the cluster uses IAM auth is where the work is.
Moving from Ingress to Envoy Gateway
What the Gateway API actually changes, and why the interesting part of the migration was ownership rather than routing.
Terraform ownership for a multi-service AWS estate
The hard part of Terraform at scale is not modules — it is who is allowed to change what, and how wide the blast radius is when they do.
Self-service is a documentation problem
We gave developers a GitOps path to production. Adoption didn't move until the paved road was written down properly.
Replacing Kaniko with BuildKit in shared CI
Kaniko was fine until multi-arch and a shared pipeline include needed a daemon that could actually build both. Migrating without breaking every consumer was the real work.
MSK backup without a practiced restore is theatre
We automated Kafka backups to S3 with MSK Connect and Terraform. The useful part was timing a real restore and learning where the tooling still forces you to be explicit.