Most projects don't have a configuration system — they have a pile: a .env file, a Makefile, a CI workflow, and secrets in a fourth place, none of it validated and all of it slowly drifting apart. cuenv replaces that pile with a single typed env.cue written in CUE. In this overview I'll show you how it validates your config before anything runs, resolves secrets at runtime, runs your tasks as a cached DAG, and generates your CI from the same definitions.

cuenv: one typed file for your whole project

timgs/cuenvthumb.png

Compare the top cloud-native certifications in 2026 — CKA, CKAD, CKS, KCNA, KCSA, Istio, Prometheus, and more: what each costs, where to take them, and the best learning resources to prepare.

Top Cloud-Native & Kubernetes Certifications [2026 Guide]

timgs/2022-07-26-certs.png

Preflight is a VSCode extension that reviews your code changes and generates PR summaries using AI — all before your code leaves your machine.

Preflight: AI Code Review Before You Push

timgs/2026-03-05-preflight-ai-code-review.png

What is an AI agent actually made of? A practical breakdown of agent anatomy — planning, reflection, tool use, memory, and multi-agent patterns — with diagrams and real examples.

Anatomy of AI Agents

timgs/2025-01-15-agents.png

This short post explains how to integrate Google Drive into your Next.js application. It covers setting up NextAuth.js, creating API routes for Google Drive access, and building a simple UI.

Accessing Google Drive from Next.js

timgs/2024-09-23-google-drive-nextjs-auth.jpeg

Learn how to streamline your deployment process using Fly.io, GitHub Actions, and Dagger. This guide walks you through setting up automatic deployments a simple todo app, from basic Fly.io CLI usage to creating efficient, reusable deployment pipelines with Dagger.

Deploying to Fly.io using Dagger and Github

timgs/2024-07-20-dagger-fly-io.jpg

While developing microservices locally is possible, running and testing them in a production-like Kubernetes environment is complex. A typical development workflow while developing service in Kubernetes can significantly slow you down - from building a Docker image, pushing it, restarting the deployments, and testing the changes in a shared cluster. In this article, I'll look at a tool called Signadot. Signadot introduces a concept of sandboxes that allow you to considerably shorten your developer workflow and go from minutes to mere seconds!

Rapid microservices development with Signadot

timgs/2023-10-26-signadot.png

CNCF announced a new certification targeting Istio. Istio Certified Associate is meant for engineers, CI/CD practitioners or anyone interested in Istio. We did a full week of streams on YouTube, going through the exam curriculum. This article contains notes, tips, and observations from the Istio Mesh Week live streams

How to prepare for Istio certified associate exam (ICA)

timgs/2023-10-10-meshweek.png

Set up a global rate limiter in Istio using Envoy's rate limit service: deploy the service, configure descriptors for real-world scenarios, and monitor rate limits with Prometheus and Grafana.

Global Rate Limiting in Istio with Envoy Rate Limit Service

timgs/2023-07-28-global-rate-limiter.jpg

I share a quick look into my history with Istio and how I've seen it evolve from an incubating project to a graduated one.

My Journey with Istio: From Incubation to Graduation

timgs/2023-07-12-istio-graduates.png

Hands-on Cilium network policy tutorial: write ingress and egress NetworkPolicies, add Layer 7 (HTTP-aware) rules with CiliumNetworkPolicy, and visualize allowed and denied flows with Hubble.

Hands-on Cilium tutorial: write ingress and egress NetworkPolicies, add Layer 7 HTTP rules with CiliumNetworkPolicy, and see allowed vs. denied traffic live with Hubble.

Cilium Network Policy Tutorial: Secure Kubernetes Step by Step

timgs/2023-06-14-cilium-network-policy.jpg

Deep dive into Kubernetes networking: how kube-proxy programs iptables rules, pod-to-pod and pod-to-service traffic, the role of CNI and kubelet, and iptables vs. IPVS mode — with hands-on examples you can trace yourself.

How does kube-proxy actually use iptables? Trace pod-to-pod and pod-to-service traffic through real iptables chains, understand CNI and kubelet roles, and compare iptables vs. IPVS mode.

Kubernetes Networking: How kube-proxy and iptables Work

timgs/2023-05-31-kubeproxy-iptables.jpg

Complete guide to Istio ServiceEntry: add external services to the mesh, choose between DNS, STATIC, and NONE resolution, configure endpoints for static IPs, and fix 502 errors with REGISTRY_ONLY mode.

Complete Istio ServiceEntry guide: when to use DNS vs. STATIC vs. NONE resolution, how the endpoints and addresses fields work, hostname and IP examples, and fixing 502s in REGISTRY_ONLY mode.

Istio ServiceEntry: DNS vs. STATIC Resolution & Endpoints Explained

timgs/2023-02-10-serviceentry-feature.jpg

Yes, you can apply an Istio DestinationRule to all workloads in the mesh. Learn how DestinationRule scoping works (root namespace vs. workload namespace), how to set mesh-wide TLS and traffic policies, and the gotchas to avoid.

Yes, you can apply an Istio DestinationRule to every workload in the mesh. Learn how DestinationRule scoping works, how to set mesh-wide defaults from the root namespace, and the gotchas to avoid.

Apply an Istio DestinationRule Globally (Mesh-Wide)

timgs/2023-02-03-global-dr.jpg

Step-by-step guide to local rate limiting in Istio: how Envoy token buckets work, configuring per-workload limits with EnvoyFilter, and rate limiting at the ingress and egress gateways.

Step-by-step Istio rate limiting guide: how Envoy token buckets work, per-workload local rate limits with EnvoyFilter, and limits at the ingress and egress gateways.

Istio Rate Limiting: Configure a Local Rate Limiter in Envoy

timgs/2022-09-08-ratelimit-istio.jpg

This article explains how to expose custom ports on the Istio ingress and how can you use the same host name, but different port, and route the traffic to two (or more) Kubernetes services.

Learn how to expose custom ports on the Istio ingress and use the same host name, different port, and route the traffic to two (or more) Kubernetes Services

How to expose custom ports on Istio ingress gateway

timgs/2022-08-01-custom-ports-ingress.jpg

Install Portainer on Kubernetes and manage containers from a web UI: step-by-step installation with Helm, creating namespaces, and deploying your first app — no kubectl required.

Portainer Tutorial: A Web UI for Kubernetes & Containers

timgs/2022-06-02-portainer.webp

The challenge that I'll explore today is that you have an HTTP service exposed through Traefik Proxy and you want to deal with the HTTPS burden (TLS termination), leaving your pristine service unspoiled by mundane technical details.

Traefik Proxy 2.x and TLS 101

timgs/2022-05-31-traefik-tls.webp

A collection of more than 20 useful and practical Kubernetes CLI tips from the Kubernetes community.

Kubernetes CLI (kubectl) tips you didn't know about

timgs/2022-05-10-kubectl-tips.jpg

SSL certificates are a must these days. They helps protect the data being sent between the server and the client by encrypting it, which gives your website more credibility. In this blog post I will explore a couple of different ways you can obtain SSL certificates and configure the Istio Gateway to use them.

Learn about different ways you can obtain SSL certificates and configure the Istio Gateway to use them.

Setting up SSL certificates with Istio Gateway

timgs/2019-12-04-setup_ssl_certs_with_istio_gateway_part_i.jpeg

This article contains a set of 10 best practices for Argo Workflows, ArgoCD, and Argo Rollouts.

ArgoCD Best Practices You Should Know

timgs/2022-04-25-argocd-best-practices.png

In this article, I will demonstrate easy steps of preparing and launching compute-intensive AI applications on OCI Ampere A1 shape to take advantage of the best-in-class AI inference performance of Ampere Altra processor and Ampere Inference Optimizer (AIO).

Prepare and launch a compute-intensive AI applications on OCI Ampere A1 shape.

Running AI On OCI Ampere A1 Instance

timgs/2022-03-16-running_ai_on_ampere_instance.jpg

GitOps makes configuration management seamless by creating a single source of truth for configuration changes so that changes can be transparent, validated, and low-risk. This article and this GitHub repository will show you how Traefik Proxy and Flux can work together to help you implement GitOps principles. But before we jump in, what are these tools, and how do they help?

How to Deploy Traefik Proxy Using Flux and GitOps Principles

timgs/2022-03-09-deploy-traefik-using-flux.jpg

Run Firebase locally with Next.js: set up the Firebase Emulator Suite for Auth and Firestore, connect your Next.js app in development, and stop touching production data while you build.

Firebase Emulators with Next.js: Local Setup Guide

timgs/2022-03-04-firebase-emulators.jpg

In this article, I'll take you on a journey of setting up a free-for-life virtual machine instance running on OCI. We'll be creating the account, a virtual machine instance, creating a Github repository with Hugo, setting up Nginx on the VM, and obtaining a free SSL certificate.

Set up a Hugo blog on an OCI instance. Includes setting up nginx, obtaining a free SSL certificate, and setting up a Github repository.

Running Hugo on free Ampere VM (Oracle Cloud Infrastructure)

timgs/2022-01-30-blog-on-oci.jpeg

kwatch is an open-source tool that detects crashes in Kubernetes Pods in real-time and sends the notifications to supported backends. In this post, we'll show you how to deploy and configure kwatch to send Kubernetes Pod crash notifications to PagerDuty.

How to use kwatch to detect crashes in Kubernetes clusters

timgs/2022-01-25-kwatch-pagerduty.jpeg

In this blog post, we will discuss continuous profiling and then instrument a couple of microservices running on Kubernetes using an open-source tool called Pyroscope.

Continuous profiling in Kubernetes using Pyroscope

timgs/2022-01-15-pyroscope-k8s.png

Monitoring with cAdvisor allows you to gather information about individual Docker containers. cAdvisor runs as a daemon and collects the information about running containers, crunches the data, and exports it to your backend system of choice (Prometheus, ElasticSearch, StatsD). This article shows you how to install cAdvisor and get the metrics to show up on a dashboard in Grafana.

Monitoring containers with cAdvisor

timgs/2021-08-23-cadvisor.jpeg

In this first lab in the series of Kubernetes labs, we'll learn how to create a Kubernetes cluster in Google Cloud

Creating a Kubernetes cluster in Google Cloud (LAB)

timgs/2021-07-07-gcp-k8s-cluster.jpeg

You've created your Kubernetes cluster and now it's time to put it to use. In this second lab you'll create your first Kubernetes Pod and your first Kubernetes ReplicaSet

Your first Kubernetes Pod and ReplicaSet (LABS)

timgs/2021-07-10-pods-replicasets.jpeg

The concept of hooks is well-known in the tech world. Events usually trigger hooks, and they allow developers to react to those events and run some custom code. But how can you do the same in the context of Kubernetes and containers?

Container Lifecycle Hooks

timgs/2021-05-03-container-lifecycle-hooks.jpeg

Have you ever said "THIS WORKED YESTERDAY!!". Yeah, me too. This could also be titled Living on the edge with Wasm or The tale of a stray character or How I spent way more time I would like to admit, fixing an issue that was completely my fault

Maybe Convert Wasm Extension Config?

timgs/2021-04-23-curious-case-of-stray-char.jpeg

GetIstio CLI was released this week. GetIstio features aCLI that offers an easier way to install and upgrade Istio, a free Istio Fundamentals training, and a community, with the first meeting coming up on February 18th.

GetIstio - CLI, training, and community

timgs/2021-02-11-getistio-cli.jpeg

In this post, you'll learn how to expose multiple Kubernetes services running inside your cluster using Istio' Gateway and VirtualService resources.

Attach multiple VirtualServices to Istio Gateway

timgs/2020-11-23-multiple-vs-gateway.jpeg

What happens to your data when Kubernetes reschedules a Pod? Learn how Volumes, PersistentVolumes, and PersistentVolumeClaims store data outside containers so it survives restarts and node failures.

Kubernetes Volumes Explained: Keep Data Beyond the Pod

timgs/2020-11-11-kubernetes-volumes.jpeg

I needed a way to send a notification to a Slack channel, whenever I push new versions of Docker images to the registry. This post, I explain how I created a function that uses a container registry webhook to call a serverless function that sends a message to a Slack channel.

Send a Slack message when Docker images are updated

timgs/2020-10-14-docker-push-slack.jpeg

Using the NetworkPolicy resource, you can control the traffic flow for your applications in the cluster, at the IP address level or port level (OSI layer 3 or 4).

Kubernetes Network Policy

timgs/2020-10-07-network-policies.jpeg

The ambassador container pattern aims to hide the primary container's complexity and provide a unified interface through which the primary container can access services outside of the Pod.

Ambassador Container Pattern

timgs/2020-10-03-ambassador-pattern.jpeg

Start Kubernetes will teach you everything you need to know to use Kubernetes effectively.

Start Kubernetes Release

timgs/2020-10-01-start-kubernetes.jpeg

The sidecar container aims to add or augment an existing container's functionality without changing the container. In comparison to the init container from the previous article, the sidecar container starts and runs simultaneously as your application container. The sidecar is just a second container you have in your container list, and the startup order is not guaranteed.

Sidecar Container Pattern

timgs/2020-09-30-sidecar-container.jpeg

Init containers allow you to separate your application from the initialization logic and provide a way to run the initialization tasks such as setting up permissions, database schemas, or seeding data for the main application, etc. The init containers may also include any tools or binaries that you don't want to have in your primary container image due to security reasons.

Kubernetes Init Containers

timgs/2020-09-26-init-containers.jpeg

Istio allows you to enable or disable different components, as well as tweak the configuration for them. However, what do you do if you want to deploy another ingress gateway? In this article, I go through a couple of exercises and try to deploy a second ingress gateway.

Deploying multiple Istio Ingress Gateways

timgs/2020-01-09-deploying_multiple_gateways_with_istio.jpeg

The strangler pattern is useful for scenarios where you can intercept the calls at the edge of your monolithic application. But what do you do in a scenario where the functionality you're trying to extract is not called directly from the outside, rather it is being called from multiple other places inside the monolith?

Branch by Abstraction Pattern

timgs/2020-08-14-branch-by-abstraction-pattern.jpeg

The strangler pattern is used in scenarios when you're migrating from monolithic systems by extracting pieces of functionality and moving that functionality into new services. This article explains how the pattern works and how to implement it. 

The Strangler Pattern

timgs/2020-08-11-the-strangler-pattern.jpeg

One part of the Start Kubernetes course I am working on (in addition to the book and videos) is the interactive labs. The purpose of these labs is to help you learn Kubernetes by solving different tasks, such as creating pods, scaling deployments, and so on. What follows is a quick explanation of how the end-user experience looks like and how I've set up my development environment for it.

Kubernetes Development Environment with Skaffold

timgs/2020-07-12-kubernetes-development-environment-with-skaffold.jpeg

In addition to routing the incoming requests or exposing service API's through a single endpoint, the ingress gateways does other tasks, such as rate limiting, SSL termination, load balancing, authentication, circuit breaking and more.  In this article I will show you how to install the Ambassador Gateway and other components to be able to obtain an SSL certificate for your application.

Securing Kubernetes Ingress with Ambassador and Let's Encrypt

timgs/2020-06-24-ssl-ambassador-lets-encrypt.jpeg

You deployed your applications to Kubernetes and now you need a way for your users to access them. You can do that with a Kubernetes Ingress resource and an Ingress controller. This article explains all about the Ingress resource and shows you how to expose multiple applications through a domain, subdomain and on a different URL path.

All About the Ingress Resource

timgs/2020-06-18-kubernetes-ingress.jpeg

To investigate and debug the containers within a pod you need to remove the pod from the load balancing pool, so none of the traffic gets sent to it. This tip shows you how to do that.

How to quarantine Kubernetes pods?

timgs/default-title-12.jpeg

In this multi-part series of articles I'll try and capture everything I think someone who wants to learn and work with Kubernetes should know about. If you have read any of my previous articles or courses you know that I like to learn by practice and trying things out. I'll explain theoretical things, but will focus more on the practical parts.

All the basics you need to know about Kubernetes. Practical guide for beginners with examples.

Getting started with Kubernetes

timgs/2020-05-26-getting-started-with-kubernetes-part-1.jpeg

In this article, I'll talk a bit about data partitioning. Specifically, I'll talk about horizontal data partitioning or sharding. After a brief 'theoretical' part, I'll show you an example of how you can configure sharding with MongoDB. You will be able to run three MongoDB shards, a configuration server, and a router on your computer, using Docker compose.

Horizontal partitioning in MongoDB

timgs/2020-05-12-horizontal-partitioning-or-sharding-in-mongodb.jpeg

In this short article I'll talk about two things - the latest tag in Docker and why you should be careful when using it and how you should come up with your own tagging scheme for your Docker images.

Docker image tagging scheme

timgs/default-title-11.jpeg

I have been using Docker directly or indirectly for years now. During that time I shot myself in the foot multiple times by not following suggestions and good practices. I have collected tips and practices and separated them into multiple categories. I am calling these categories Dockerfiles, images, and containers. The first part talks about Dockerfiles - I have included 6 tips and practices you should try and adopt.

Practical tips and tricks for working with Dockerfiles

Six things to keep in mind when working with Dockerfiles

timgs/default-title-10.jpeg

Understanding concepts around Docker images and containers is crucial for anyone starting in cloud-native. Regardless if you're in development, DevOps or program management (or any other technical role :). Once you grasp the basics of Docker it will be so much easier for you to understand things like Kubernetes, service meshes and pretty much any other cloud-native tool works. You can think of this guide as the first practical guide to learning about cloud-native.

Understanding Docker concepts is crucial for anyone starting in cloud-native. Learn the basics of Docker, which is the basis of Kubernetes, Istio and other cloud-native tools.

Beginners guide to Docker

timgs/2020-04-29-beginners-guide-to-docker.jpeg

Have you heard of gateways, proxies, load balancer, API gateways? This article explains what gateways are, what is their purpose and how they work with practical examples

Beginners guide to gateways and proxies

timgs/2020-04-25-beginners-guide-to-gateways-proxies.jpeg

The rising demand for hard kubernetes multitenancy, either for customers of a SaaS offering or to support disparate internal teams within an organization, coupled with mass adoption of service-meshes (Istio being the more popular of the choices), we are starting to notice a need for supporting multiple meshes within a single Kubernetes cluster.

Deploy and Operate Multiple Istio Meshes in one Kubernetes Cluster

timgs/default-title-1.jpeg

If you ever wanted to quickly evaluate service meshes and even run a couple of performace tests, you might want to look into Meshery. Meshery is a multi-service mesh management plane for lifecycle, config and performance management of service meshes.

Managing service meshes with Meshery

timgs/2020-03-12-meshery-service-mesh-management-plane.jpeg

Learn how circuit breakers protect your services in an Istio service mesh — connection pool settings, outlier detection, and a hands-on demo of tripping the breaker before failures cascade.

Circuit Breaking in Istio Explained

timgs/2020-02-28-circuit_breakers_in_istio_explained.jpeg

This article explains how to build a simple CI using Github Actions. It involves triggering the workflow only on version file changes, parsing the image names and then building, tagging and pushing the images to the Docker registry.

Build and push your Docker images using Github Actions

timgs/default-title-8.jpeg

In the past year, I have done multiple workshops on Kubernetes, Istio and cloud-native development. As part of my workshops I usually start with theory and explain the concepts using slides, show some demos, but then it's on you, the participant to try out the technology yourself.

Kubernetes and Istio service mesh workshop materials

timgs/default-title-7.jpeg

Ever wondered how you can build your own system that automatically updates your React app each time you push changes to the repository where your app is hosted? In this article I explain how you can use build a Netlify-like deployment for React apps using a multi-container Kubernetes pod.

Learn how to build a Netlify-like deployment for React apps using a multi-container Kubernetes Pod.

Build Netlify-like deployment for React app using Kubernetes pods

timgs/2020-01-06-build_your_own_netlify_like_deployment_for_react_apps_with_kubernetes.jpeg

Istio 1.4.0 was released on November 14th and it came with a lot of new features and enhancements. In this article I go through my favorite six improvements, including the new and simple way of installing Istio and opening dashboards.

Six exciting enhancements in Istio 1.4.0

timgs/default-title-6.jpeg

The fallacies of distributed computing or distributed system are a collection of eight statements made by L. Peter Deutsch and others at Sun Microsystems about false assumptions people new to developing distributed applications make. Here's the list of 8 fallacies of distributed systems

Fallacies of Distributed Systems

timgs/2019-11-26-fallacies_of_distributed_systems.jpeg

The CAP theorem, also named Brewer's theorem after computer scientist Eric Brewer, states that it is impossible for a distributed system to simultaneously provide more than two out of the following three guarantees - consistency, high availability, and partition tolerance.

Tooling

cuenv: one typed file for your whole project