Carlos Nunez

Our most popular RAG solution now has support for ACLs in the cloud ingestion pipeline! Bring your existing ADLS2 blob storage account or create a new one, and the indexer will extract the oids/groups based off blob ACLs, and store those on the oids/groups fields in the AI Search index. Then, when the user is logged in, they can only chat with documents which they're allowed to access! Release notes here: https://lnkd.in/ewQfJ6Sg

85

1 Comment

Automating Multi-Environment ECS Infrastructure with Terraform Modules One of the biggest challenges organizations face when scaling AWS ECS workloads isn’t just running containers—it’s managing multiple environments reliably. Dev, staging, production, and even region-specific deployments often drift apart when they’re built manually. Over time, this leads to fragile systems, unpredictable performance, and security gaps. As Solution Architects, our job is to prevent this drift and design automation patterns that balance flexibility with governance. Terraform modules are the foundation of this strategy. 🔍 The Multi-Environment Challenge Without automation, here’s what usually happens: Each environment is set up manually → differences creep in Developers copy-paste Terraform code between environments → duplication grows Fixes applied in one environment don’t always make it to others Scaling across regions or business units becomes a nightmare The result: wasted time, inconsistent infrastructure, and high risk when promoting workloads to production. 🚀 The Terraform Module Approach Terraform modules solve this by creating reusable building blocks that encapsulate best practices while exposing configurable variables. Here’s how I design ECS infrastructure modules: 1️⃣ Networking Module VPC, subnets, routing, NAT gateways Parameterized for CIDR ranges and AZ counts 2️⃣ ECS Cluster Module Cluster definition (Fargate or EC2 launch type) IAM roles for execution and tasks Logging and monitoring integration 3️⃣ Service Module Task definitions with container images, CPU/memory limits Load balancer integration via target groups Autoscaling policies tied to CloudWatch metrics 4️⃣ Security Module Security groups and IAM roles with least privilege Secrets Manager or SSM Parameter Store integration 📦 Environment-Specific Flexibility By combining these modules, you can spin up dev, staging, and prod clusters with minimal changes: Variables define region, scaling thresholds, or instance size The same codebase serves multiple environments, reducing drift Each environment benefits from identical architecture and security posture This design also makes it easy to replicate environments across new regions, business units, or customer accounts. 💡 Value Delivered ✔️ Consistency: Every environment is identical in structure ✔️ Velocity: New environments spun up in minutes, not weeks ✔️ Governance: Security and compliance controls embedded in modules ✔️ Cost Efficiency: Scaling policies tuned per environment without rewriting code ✔️ Auditability: Git history provides a single source of truth 🎯 Architect’s Leadership Role Terraform modules are not just code—they’re organizational standards. As architects, our role is to: Define the baseline modules that encode best practices Ensure teams don’t “reinvent” infrastructure patterns in silos Mentor engineers on module composition and variable design

5

Live VM migration. Shared Raw Block. No downtime. Portworx Enterprise 3.3 is here - and it’s built for the future of virtualization on Kubernetes. New in 3.3: - Shared Raw Block for seamless VM live migration - FADA ActiveCluster for synchronous data replication - App I/O control with cgroups v2 - Enhanced security, diagnostics, and networking features If you're modernizing virtualization or standardizing on Kubernetes, this is the storage layer that keeps up. Read the full release: Portworx Enterprise 3.3: Powering Modern Virtualization with Shared Raw Block: https://lnkd.in/ezEakYJg #Portworx #Kubernetes #Virtualization #KubeVirt #OpenShift #CloudNative #DevOps #Containers #Storage #PlatformEngineering

68

Most security tools weren’t built for Kubernetes—let alone multicloud. NGFWs fail to understand Kubernetes constructs. K8s tools don’t speak to IaaS. Service meshes don’t cover egress. It all adds up to security gaps and operational overhead. The Aviatrix Kubernetes Firewall bridges the gap. This infographic breaks down where traditional tools fall short and how Aviatrix simplifies, centralizes, and secures policy enforcement across your cloud-native and IaaS environments. 📎 View the full infographic: https://loom.ly/94wgTcM #Kubernetes #Multicloud #CloudNetworking #Aviatrix #ZeroTrust #CloudSecurity

24

🚀 Bare metal is making a serious comeback, especially for Kubernetes! But when is ditching the VMs for raw hardware really the right move for your K8s clusters? 🤔 It's a hot topic, and many are surprised by the clear advantages in specific scenarios. If you're nodding along, here’s a quick breakdown: 🎯 𝗕𝗮𝗿𝗲 𝗠𝗲𝘁𝗮𝗹 𝗦𝗵𝗶𝗻𝗲𝘀 𝗪𝗵𝗲𝗻: → 𝗠𝗮𝘅𝗶𝗺𝘂𝗺 𝗣𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲 𝗶𝘀 𝗮 𝗠𝘂𝘀𝘁: Direct hardware access means minimal hypervisor overhead and no noisy neighbors hogging resources. Your critical tasks get full infrastructure capacity. → 𝗬𝗼𝘂 𝗡𝗲𝗲𝗱 𝗟𝗼𝘁𝘀 𝗼𝗳 𝗜𝗻𝗳𝗿𝗮 𝗙𝗹𝗲𝘅𝗶𝗯𝗶𝗹𝗶𝘁𝘆: Got specialized, too new, or too old hardware? Bare metal handles it. Access different kernels and fully leverage unique hardware capabilities (like specific network cards) → 𝗬𝗼𝘂 𝗪𝗮𝗻𝘁 𝗙𝘂𝗹𝗹 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗼𝗳 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆: Single tenancy reduces the attack surface. No hypervisor vulnerabilities to worry about, plus you control kernel updates, encryption, and can use hardening frameworks like SELinux/AppArmor. → 𝗬𝗼𝘂 𝗡𝗲𝗲𝗱 𝗠𝗮𝘅𝗶𝗺𝘂𝗺 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗣𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲: Fewer abstractions mean better network speeds. Tools like CNI, flannel, and Calico make setup and routing smoother, and troubleshooting is often simpler. → 𝗬𝗼𝘂 𝗪𝗮𝗻𝘁 𝘁𝗼 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗖𝗼𝘀𝘁𝘀: Optimal resource utilization and predictable scaling costs can lead to significant savings-up to 30% TCO reduction in some cases! Plus, no hypervisor licensing fees. 🚧 𝗕𝘂𝘁, 𝗜𝘁'𝘀 𝗡𝗼𝘁 𝗔𝗹𝘄𝗮𝘆𝘀 𝗦𝗺𝗼𝗼𝘁𝗵 𝗦𝗮𝗶𝗹𝗶𝗻𝗴. 𝗧𝗵𝗲 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀: → 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗖𝗼𝗺𝗽𝗹𝗲𝘅𝗶𝘁𝘆: Forget "click-and-go." Provisioning, updates, networking, DNS, storage, and scaling are all on you. OS patching and certificate management? Your responsibility. → 𝗢𝗽𝘁𝗶𝗼𝗻𝗮𝗹𝗶𝘁𝘆 𝗢𝘃𝗲𝗿𝗹𝗼𝗮𝗱: The "blank slate" can be daunting. Choosing and ensuring compatibility for OS, interfaces, and hardening solutions requires careful planning and dedicated team resources. Choosing bare metal for K8s isn't a decision to take lightly, but for the right workloads, the benefits are undeniable! Learn more in my post here: https://lnkd.in/gqFduUsN

24

From Terraform to Crossplane Kubernetes-native IaC is evolving—are you keeping up? Crossplane is redefining how we manage infrastructure: declarative, secure, and fully integrated with the K8s ecosystem. Think Terraform, but closer to your cloud-native apps. -YAML over DSL -Native RBAC & multi-tenancy -Seamless integration with Helm, Operators & more Explore how Crossplane offers the next-gen control plane—bridging DevOps and Platform Engineering like never before. #InfrastructureAsCode #Crossplane #Kubernetes #CloudNative #DevOps #PlatformEngineering #MSysTechByte #Infraunlocked #MSysTechnologies

13

Demand for managed Kubernetes on GPU infrastructure is surging. 40% of GPU cloud customers want a turnkey, Kubernetes-native service. vCluster and vNode provide the architecture to launch your managed Kubernetes offering in weeks, not months. Virtual control planes give each customer their own isolated API server, etcd, and RBAC on shared infrastructure. No separate physical clusters to manage. Three deployment models for different service tiers: - Shared Nodes: Soft isolation for high-density serverless GPU workloads - Dedicated Nodes: Hard isolation with dedicated GPU pools per tenant - Private Nodes: True node-level isolation for enterprise customers No VMs. No hypervisor overhead. Just bare metal GPU performance with the tenant isolation and security your customers require. Launch faster. Support multiple service tiers. Maximize revenue per GPU. Stand apart from hyperscalers with infrastructure purpose-built for AI/ML workloads. Schedule a call to discuss how vCluster + vNode can power your managed Kubernetes offering: https://lnkd.in/egKS4pcX (Full technical architecture in the comments)

745

3 Comments

Cloudflare rebuilt Next.js in one week for $1,100 in AI tokens. Not a prototype. A production-grade runtime already running on a .gov domain. This changes a decision framework every engineering leader uses. BUILD-VS-BUY IS NOW THREE OPTIONS ━━━━━━━━━━━━━━━━━━━━ I wrote a full analysis covering: → The 4 conditions that must ALL be true before cloning makes sense → Why integration cost collapse is the real story → What this means for open-source business models → A practical decision framework for engineering leaders Read here: https://lnkd.in/gWDQpgep

14

1 Comment

Managing Kubernetes at scale means dealing with pod crashes, alert storms and cascading failures, often at 2 a.m. Manual triage and tribal knowledge can't keep up. Our new eBook shows how to automate Kubernetes incident response with AI-powered diagnostics, intelligent remediation and proactive workflows that cut MTTR and eliminate toil. Download now ➡️ bit.ly/4qiczWJ

11

Infrastructure challenges only get harder after deployment. That's where Terraform actions bring real value. By standardizing more of your Day 2 workflows within the Terraform pipeline, you can confidently manage infrastructure over time without the manual overhead. A perfect example? Pairing Ansible with Terraform actions for seamless, automated infrastructure and configuration management. Ready to transform how you operate? https://bit.ly/3WKwCk6

54

The telemetry pipeline implementations that fail almost never fail for technical reasons. They fail because someone skipped the boring stuff. After watching dozens of organizations go through this process, the pattern is crystal clear: The teams that succeed treat pipeline adoption like organizational change, not just infrastructure deployment. Here's what trips people up: → No clear objectives. "We want to modernize" isn't a goal. "Reduce ingest costs by 30%" is. → No telemetry inventory. Most organizations have zero idea what data they're generating or who uses it. This audit typically surfaces 20-40% of data that can be eliminated immediately. → Fuzzy ownership. A centralized pipeline changes power dynamics. If nobody owns cost outcomes and policy enforcement, the pipeline becomes "someone else's problem." → Going too big too fast. The teams that migrate everything at once? They're writing postmortems six months later. → Opacity kills adoption. "We dropped your logs, trust us" is how you get shadow agents and workarounds. We built a 10-point preparation checklist covering the work that matters, before you talk to a single vendor or write a line of code. Link 👇 https://lnkd.in/gYCMNN5b #telemetry #observability #platformengineering

10

Kubernetes monitoring shouldn’t feel like a game of hide and seek. We’ve reimagined it in Splunk Observability: think smarter insights, smoother navigation, and all your data (yes, even YAML) right where you need it. No more wild goose chases, just faster fixes and clearer views. Want to see how? Get the full scoop on #SplunkBlogs 👇 #SplunkO11y

241

2 Comments

We just launched one-click Slurm deployment on Kubernetes. Yes, ONE CLICK. No more choosing between Slurm workflows and Kubernetes flexibility. Get both. Deploy in minutes instead of days. Clusters that scale to zero when idle.    HPC teams have been stuck choosing between the Slurm workflows they know and love OR the flexibility of Kubernetes. Not anymore. What used to take days of deployment work now happens in minutes. No more maintaining dedicated HPC clusters. No more operational headaches. Oh, and we also launched one-click multi-node AI training deployment. Because why stop at just one release :) Read the full announcement: https://lnkd.in/gtsWpBat #HPC #Kubernetes #Slurm #AIInfrastructure #EnterpriseAI

14

Engineering teams spend a long time automating workflows. Where that time should be going, however, is autonomous actions. Automating workflows is the belief that said workflows will stay static. That’s never what happens. Stacks change, libraries/packages change, deployment destinations change, security needs change, and hundreds of other things. Autonomous workflows, on the other hand, are all about an end state that’s expected regardless of the changes going on. This is why autonomous Agents will be so relevant in 2026. #kubernetes #ai #platformengineering

22

2 Comments