Kiril Urbonas

Founder & Chief Editor

586 articles published

About the author

Kiril Urbonas is the founder and chief editor of DevOpsNess. He works hands-on with LLM systems, cloud infrastructure, and DevOps tooling, and writes and edits every article, drawing on production work across AI/MLOps, Kubernetes, Docker, Terraform, CI/CD, and Linux: real costs, real incidents, and the tradeoffs behind each decision.

How articles are researched, verified, and corrected is described in the editorial policy.

A FROM line pointing at a host like x.azurecr.io.attacker.com is enough to make kaniko hand the build's Entra ID token to that host. Which kaniko forks and images are affected, how to find Azure identities in your build pods, and what to rotate.

••yesterday

kaniko CVE-2026-105769: Lookalike ACR Hosts Get Your Azure Token. Rebuild on v1.25.20

A FROM line pointing at a host like x.azurecr.io.attacker.com is enough to make kaniko hand the build's Entra ID token to that host. Which kaniko forks and images are affected, how to find Azure identities in your build pods, and what to rotate.

Kiril Urbonas·8 min read·12

Read article

One workflow that builds, signs keylessly with GitHub OIDC, attaches an SBOM and SLSA provenance, plus the Kyverno policy that refuses anything unsigned. Copy it, change three names, ship it.

••last week

Sign Container Images With Cosign: Keyless GitHub Actions Workflow, SBOM and In-Cluster Checks

One workflow that builds, signs keylessly with GitHub OIDC, attaches an SBOM and SLSA provenance, plus the Kyverno policy that refuses anything unsigned. Copy it, change three names, ship it.

Kiril Urbonas·7 min read·14

Read article

Hugging Face TGI is archived and read-only, so the real 2026 choice is vLLM, SGLang or TensorRT-LLM. A feature table, a launch command for each, and the one we default to.

••last week

vLLM vs SGLang vs TGI vs TensorRT-LLM: Which LLM Server in 2026

Hugging Face TGI is archived and read-only, so the real 2026 choice is vLLM, SGLang or TensorRT-LLM. A feature table, a launch command for each, and the one we default to.

Kiril Urbonas·7 min read·29

Read article

An unauthenticated regex-compiler RCE reaching back to GitLab 7.0, no workaround, and backports on older branches that fix only the critical bug. The exact version per branch and the commands to get there.

••last week

GitLab CVE-2026-110264: A Second CVSS 10 RCE in Nine Days. Patch to 19.5.1

An unauthenticated regex-compiler RCE reaching back to GitLab 7.0, no workaround, and backports on older branches that fix only the critical bug. The exact version per branch and the commands to get there.

Kiril Urbonas·8 min read·16

Read article

.NET 8, .NET 9, the Lambda dotnet8 runtime and the Azure Functions in-process model all lose support on November 10, 2026. Inventory commands, the isolated-worker migration and a CI gate.

••last week

.NET 8 Support Ends November 10: The Lambda and Azure Functions Checklist

.NET 8, .NET 9, the Lambda dotnet8 runtime and the Azure Functions in-process model all lose support on November 10, 2026. Inventory commands, the isolated-worker migration and a CI gate.

Kiril Urbonas·8 min read·23

Read article

Three kinds of drift, two tests that catch most of it, one Prometheus exporter, and the alert rules that do not page you every Monday morning.

••last week

Monitoring ML Models in Production: Data, Concept and Prediction Drift, With Code

Three kinds of drift, two tests that catch most of it, one Prometheus exporter, and the alert rules that do not page you every Monday morning.

Kiril Urbonas·8 min read·19

Read article

A use-after-free in the IPv4 TCP handshake, present since Linux 4.4, now has a working exploit against MPTCP listeners, and every Go 1.24+ server is one by default. Which kernels are fixed and how to roll them through EKS, GKE and AKS.

••last week

CVE-2026-98432: The CVSS 9.8 Linux TCP Bug Now Has an Exploit. Patched Node Images

A use-after-free in the IPv4 TCP handshake, present since Linux 4.4, now has a working exploit against MPTCP listeners, and every Go 1.24+ server is one by default. Which kernels are fixed and how to roll them through EKS, GKE and AKS.

Kiril Urbonas·8 min read·203

Read article

The kubectl commands we actually type, grouped by the job in front of you, from switching contexts to rolling back a bad deploy. Copy-paste blocks, real output fields, and the errors that mean you are pointed at the wrong cluster.

••last week

kubectl Cheat Sheet 2026: 60 Commands Grouped by Task

The kubectl commands we actually type, grouped by the job in front of you, from switching contexts to rolling back a bad deploy. Copy-paste blocks, real output fields, and the errors that mean you are pointed at the wrong cluster.

Kiril Urbonas·8 min read·11

Read article

Run a DaemonSet agent on every node and a small gateway Deployment behind it. Two Helm values files, the processor order that keeps the Collector alive, and the errors you will hit first.

••last week

OpenTelemetry Collector on Kubernetes: Agent vs Gateway, With Configs That Work

Run a DaemonSet agent on every node and a small gateway Deployment behind it. Two Helm values files, the processor order that keeps the Collector alive, and the errors you will hit first.

Kiril Urbonas·7 min read·11

Read article

SRE interviews test numbers and judgment. Fifteen questions on SLIs, error budgets, incident command, toil, capacity, on-call and postmortems, plus a systems-design scenario, each with the answer that scores and the one that loses the room.

••last week

15 SRE Interview Questions With Answers, From SLOs to On-Call

SRE interviews test numbers and judgment. Fifteen questions on SLIs, error budgets, incident command, toil, capacity, on-call and postmortems, plus a systems-design scenario, each with the answer that scores and the one that loses the room.

Kiril Urbonas·8 min read·13

Read article

On October 20, 2026, europe-west2-b lost power when its generators never started. Cross-zone control-plane timeouts then degraded the whole London region. What happened and the gcloud audit to run now.

••last week

Google Cloud's europe-west2 Outage: One Zone Lost Power and the Region Stalled for 6 Hours

On October 20, 2026, europe-west2-b lost power when its generators never started. Cross-zone control-plane timeouts then degraded the whole London region. What happened and the gcloud audit to run now.

Kiril Urbonas·8 min read·22

Read article

Kyverno 1.19 deprecated ClusterPolicy and went all in on CEL, Gatekeeper still speaks Rego, and Kubernetes now ships validating and mutating policies natively. How to pick, with the same policy written three ways.

••last week

Kyverno vs OPA Gatekeeper in 2026: CEL, Rego, or Native Admission Policy

Kyverno 1.19 deprecated ClusterPolicy and went all in on CEL, Gatekeeper still speaks Rego, and Kubernetes now ships validating and mutating policies natively. How to pick, with the same policy written three ways.

Kiril Urbonas·7 min read·13

Read article

Page 1 of 49 · 586 posts