Engineering Knowledge Base

Field guides, production post-mortems, and architectural best practices distilled from building enterprise cloud, Kubernetes, SRE, and AI systems.

Mastering Multi-Window Multi-Burn-Rate Alerting

Eliminate alert fatigue by transitioning from static threshold CPU/memory alerts to Google SRE multi-window burn rate alerts based on user-facing SLOs.

  • 14.4x burn rate (2% budget in 1 hour) → Page on-call immediately
  • 6x burn rate (5% budget in 6 hours) → Page on-call within 30 min
  • 1x burn rate (10% budget in 3 days) → Ticket during business hours

Production Kubernetes Resilience Checklist

Essential configuration patterns to guarantee zero-downtime rolling deploys, graceful pod termination, and zone-aware scheduling.

  • Configure preStop hooks (sleep 10) to drain in-flight TCP streams
  • Mandatory PodDisruptionBudgets (maxUnavailable: 1)
  • topologySpreadConstraints across zone and hostname

Terragrunt DRY Architecture for Multi-Account AWS

Structuring production Terraform code to prevent module duplication, enforce remote state locking, and automate cross-account IAM role assumption.

  • Root terragrunt.hcl generating backend and provider blocks
  • Environment inheritance (dev, stage, prod) with mock outputs
  • DynamoDB state locking with KMS customer-managed keys

Production LLM Inference Serving Architecture

Deep dive into deploying vLLM on Kubernetes with NVIDIA GPU Operators, continuous batching, PagedAttention, and distributed vector caching.

  • PagedAttention eliminating KV cache memory fragmentation
  • vLLM Prometheus metrics (gpu_cache_usage_factor, time_to_first_token)
  • Milvus vector indexing trade-offs (HNSW vs IVF_FLAT vs SCaNN)

VMware vSphere & Windows Server Hardening

Enterprise administration runbooks for VMware ESXi clusters, PowerCLI automation, and Windows Server Active Directory security baselines.

  • PowerCLI automated snapshots and VM quiesced consistency checks
  • ESXi host Lockdown Mode and NTP synchronization validation
  • Kerberos ticket encryption policy and SMBv1 global deprecation

Shift-Left Container Security & SBOM Generation

Automating vulnerability scans in GitHub Actions with Trivy, enforcing distroless rootless containers, and signing container images with Cosign.

  • Multi-stage Docker builds using Google Distroless base images
  • Automated CycloneDX SBOM artifact generation in CI
  • Cosign keyless cryptographic image signing via GitHub OIDC