标签：#cloud

Upgrading Kubernetes clusters across a large enterprise fleet is often a balancing act between staying current with security patches and avoiding outages. By default, Google Kubernetes Engine (GKE) rolls out automatic upgrades progressively according to Google Cloud regional timelines. While regional rollout works well for standalone clusters, it does not understand your organization's business topology. If you run staging clusters in us-central1 and critical production clusters in us-east1 , a standard regional rollout could upgrade your production environment before your pre-production validation completes. The General Availability (GA) release of GKE rollout sequencing with custom stages solves this challenge. It provides platform teams with declarative control to sequence cluster upgrades across fleets, environments, and even distinct Google Cloud organizations according to business criticality rather than cloud geography. How rollout sequencing works Rollout sequencing builds on GKE fleet management. Fleets serve as logical boundaries for environments such as development, staging, and production. With rollout sequencing, you define an ordered pipeline of upgrade stages managed by a central resource called RolloutSequence . When GKE publishes a new automatic upgrade target for a release channel, or when you explicitly trigger a target version, the system creates a Rollout object. This rollout progresses through your defined stages sequentially: Control plane upgrades start in the first stage. Once all control planes in that stage reach the target version, a stage soak timer begins. Node upgrades run in parallel with control plane upgrades, respecting node pool upgrade strategies such as surge or blue-green. When both control planes and nodes complete their upgrade and satisfy the configured soak duration, the rollout advances to the next stage in the sequence. If an individual stage contains clusters that take longer than 30 days to finish upgrading—due to restr

Your datacenter needs to talk to Azure. You can send that traffic through an encrypted tunnel over the public internet, or over a private circuit that never touches it. That single choice — shared road or private rail — decides cost, speed, and reliability. Almost every organization moving to Azure keeps something on-premises, and those two worlds have to connect privately. Azure gives you two hybrid-connectivity options, and they take opposite routes to the same destination: VPN Gateway and ExpressRoute . Understanding them is really understanding one question — does your traffic ride the public internet, protected by encryption, or a dedicated line that bypasses it entirely? VPN Gateway: an encrypted tunnel over the internet Microsoft's description is exact: Azure VPN Gateway "can be used to send encrypted traffic between an Azure virtual network and on-premises locations over the public Internet." Your traffic still travels the ordinary internet, but inside an IPsec/IKE tunnel, so it is private even though the road is shared. It comes in a few shapes: site-to-site (your datacenter's VPN device to Azure), point-to-site (an individual remote worker to the VNet), and VNet-to-VNet . It is quick to stand up, needs no third party, and is inexpensive — the pragmatic default for dev/test and small-to-medium production links. ExpressRoute: a private, dedicated circuit ExpressRoute takes the other road entirely. It "lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider." The defining fact: because ExpressRoute connections do not go over the public internet , they offer "more reliability, faster speeds, consistent latencies, and higher security than typical connections over the internet." You are not tunnelling through shared roads; you have a private rail line into Microsoft's network, arranged through a connectivity provider. That extra reliability and consistency costs more and takes longer t

A practical checklist for confirming logs are collected, routed, stored, and reviewable Logs are useful only if they are available when the team needs them. In OCI, it is possible to enable service logs, route them through Connector Hub, and store them in Object Storage for later review. Connector Hub is also referenced in some Oracle material as Service Connector Hub. The setup can look simple on the surface. But from a delivery point of view, the important question is not whether the connector was created. The important question is: Can we prove that the logs are being collected, routed, stored, retained, and reviewed when needed? This article is written from a practical validation point of view. It uses a simple example: moving OCI Load Balancer logs from OCI Logging to Object Storage using Connector Hub. Scope note: this is an independent review and validation exercise. It is not a client implementation, and no production environment, customer data, or confidential information is referenced. All names, prefixes, and identifiers below are placeholders. Console labels, defaults, and behaviour can change between releases and regions, so every value should be confirmed in your own tenancy and current Oracle documentation. The goal is not to describe every possible logging design. The goal is to give a clear checklist that helps confirm the flow is working end to end. Why log retention needs validation Enabling a log is not the same as retaining a log. A team may be able to show that logging was switched on. That does not automatically prove that the data still exists for the period being questioned, that it landed where it was supposed to land, or that someone can retrieve and read it when needed. There is one detail worth stating early. There are two retention clocks, not one. Clock What it controls Where it is set Logging retention How long the log data stays inside OCI Logging On the individual log Object Storage lifecycle How long the exported copy stays in the

Link to the Source Code As a data engineer, I spend my days designing clean, optimized data structures. But at home, I face a much tougher crowd: my family. We manage our shared finances together to optimize our budget, and because of where we live and work, we have to do this in several different currencies (like USD, EUR, CZK, and UAH) Like any developer, I first tried to find a ready-made app to solve this. But I ran into a classic problem: they were either bloated with a million features we didn’t care about, or they were missing the exact features we actually needed. So, we did what any desperate family does: we opened a Google Sheet . We tracked our money there for a while, not because it was perfect, but because it helped us figure out what we actually needed from a real application. It was our "living schema design" before I wrote a single line of code. In this article, I want to show you how I looked at this problem from two sides—as a frustrated user who just wants to log expenses, and as a data engineer obsessed with clean database design. Here is the story of how I built our custom home accounting server. Part 1: Django, a Star Schema, and the Framework Battle By 2025, I was ready to replace our Google Sheet. My main programming language is Python, so I had three realistic choices: FastAPI, Flask, or Django. FastAPI is the cool kid on the block for high-speed APIs, but we didn’t expect millions of requests (unless my family suddenly grew by a factor of a million). We also needed a friendly web UI, which FastAPI isn't naturally built for. I had just used Flask for my previous project, but I wanted to challenge myself and learn something new. Django felt like an old friend I hadn't seen in years. It has amazing built-in tools (like the admin panel and great translation support), and using it was the perfect way to refresh my skills and grow as a developer. The Database: Why a "Star Schema" Actually Makes Sense As a data engineer, I didn’t want a messy data

Golden Images How I Stopped Manually Logging Into Every New Server The problem Every time I spun up a new server for a service, it worked but it wasn't actually ready . There was always one manual step left: log in, run through some interactive setup, get the application into a working state. Only after that could the server actually do its job. For one server, that's a minor annoyance. For a fleet that's supposed to scale up and down on demand, it's a dealbreaker. You can't call something "automated provisioning" if a human still has to remote in and click through a setup wizard before it's usable. The fix: capture the setup once, replay it everywhere The pattern here is usually called a golden image and the idea is simple: instead of repeating a manual setup step on every new machine, do it once, capture the result of that setup, and have every future machine apply that captured state automatically during provisioning. Concretely, I built a small tool that: Connects to a machine that's already been through the manual setup and is in a known-good state. Packages up just the state that setup actually produced not the whole machine, just the specific files/config that resulted from the manual steps. Uploads that package to storage, versioned. Then the provisioning script for every new machine downloads that package and applies it automatically as part of boot no human, no remote session, no wizard. The mistake worth mentioning My first version of this captured too much. Instead of packaging just the setup-derived state, it grabbed an entire application data folder which included the application's own installed binaries, not just the configuration that setup had produced. That meant every new machine, when it applied the "golden" package, got its fresh application install silently overwritten with whatever binary version happened to be running on the machine I captured from. New servers ended up running an older version of the software than the one they'd just install

DigitalOcean App Platform is a metered system charged by app; Peon provisions limitless services to your existing Droplet. A practical pricing and feature comparison. The same cloud, but two very distinct approaches. There are two methods of deploying your app with DigitalOcean, and the pricing disparity between the two may be much greater than you expected. App Platform is the managed PaaS service: you integrate with the code repository, and DigitalOcean provisions, deploys and maintains your app. The costs include monthly rates per component starting at $5 for web services plus separate payments for workers plus $7+ for a development database and $15+ for a production database. The alternative way is just a regular Droplet: either a $6 VPS (1 CPU, 1 GB) or a $12 VPS (1 CPU, 2 GB) with ability to run as many containerized apps as it has available resources. Traditionally, the droplet approach required self-managing your infrastructure, exactly what a platform like Peon fixes. Cost at small scale, with real numbers For example, take a regular indie/agency load of three small apps, shared Postgres, and Redis. In App Platform, this would cost about $37 a month, where three web services ($15), a managed dev database ($7), and Redis ($15) are the cheapest tier offerings (share CPU, limited to 512 MB memory). On one $12 Droplet using Peon, $12 for the Droplet, $6 for three projects running, all with access to 2 GB of memory plus. About $18 per month total, and the ability to use as much memory as the application needs (without being limited to 512 MB slices). And this ratio grows with every additional service, as the costs for the additional Droplet resources are already included. The fourth app on App Platform will add somewhere between $5 and $12 of the bill; on your own Droplet, $2. Comparison of features Push Git deployment: both, with build log Automatic HTTPS for custom domains: both Roll out and roll back with zero downtime: both Database support: App Platform nee

The correlation notice fired. Three sites, same anomaly type, inside the time window. The orchestrator caught it and logged it, live, against the deployed service. Clean, first try. Then I asked myself a question I almost didn't bother asking, because the thing had just worked: why did it work? The answer wasn't "because the logic is correct." It was "because Cloud Run happened to route both requests to the same running instance." Well, shit. My orchestrator was holding its list of recent risk events in a plain Python list, in process memory. Worked in local testing because there's only one process. Worked live because Cloud Run, under light traffic, often reuses the same instance instead of spinning up a second one. Neither one's a guarantee. The moment traffic patterns shifted and two readings landed on two different instances, the second instance wouldn't have a clue the first one existed. A correlation that should fire would just silently not. A bug that passes its own demo is the hardest kind to catch. There's no error to chase. There's just a checkmark. What I was building VES Fleet is a network of independent site-agents (Bori, Choba, Etche, three real survey sites in the Niger Delta). Each one reads an underground electrical survey, send current into the ground, measure how it flows back, a real physical signal of what's down there, and calibrates its own contamination-risk threshold from its own site's real history. Not a number copied from anywhere else. An orchestrator watches for the same risk signature showing up at more than one site inside a time window. It's my submission to the Fortified Enterprise Fleet track of Google's All Things Agentic Hackathon. Architectural discipline is 30% of the score there. Proving it actually runs on Google Cloud is a separate 30%. So a bug that only looked fixed was never going to survive someone actually reading the state-management story. Checking the thing that already worked Once I understood the actual failure mod

Honestly, when I saw Cloudflare's announcement, my first reaction wasn't "oh cool, something new"—it was "there goes another giant company proving the thing I've been saying all along." What Cloudflare Actually Did On August 4, Cloudflare (yes, the infrastructure giant that blocks traffic and runs CDNs for half the internet) launched "Cloudflare Wallets" and something called cloudflare.pay. It gives AI agents three things they didn't have before: An identity —a recognizable wallet handle so others know exactly which agent is paying A wallet —funded with stablecoins, so the agent can actually pay A spending cap —and this one is enforced by Cloudflare's infrastructure itself The structure here is what I think matters most. You (the human) hold an Account Wallet where the funds live; then, through an API key, you grant a limited slice of spending power to individual Virtual Wallets that your agents actually use. Here's the analogy that makes it click: the Account Wallet is your company's master account, and each Virtual Wallet is a prepaid card with a spending limit that you hand to one of your AI employees. The only difference is these "employees" are AI, and the limit on the card isn't managed by a credit card company's risk engine—it's written directly into Cloudflare's infrastructure. Payments run through the now widely-discussed x402 protocol: an agent wants to buy a service, and it pays for that one transaction on the spot with stablecoins. I should be upfront about something: it's not fully usable yet. As of August 5, it's in a "launched, you can reserve your cloudflare.pay name" state. The real funding, Virtual Wallets, and programmatic spend controls are, per Cloudflare, coming "over the next few months." So this is a clear directional statement, not a mature product you can fully adopt today. Why I'm Not Reading This as "One New Product"—I'm Reading It as an Industry Consensus If this were just Cloudflare doing its own thing, I wouldn't bother writing about i

Apple says it will no longer ditch using its icloud.com domain for hiding people's email addresses.

Data has become one of the most valuable assets for modern enterprises, powering everything from business intelligence dashboards to machine learning models and generative AI applications. However, the biggest challenge organizations face today is not collecting data — it is trusting it. Enterprise data often contains duplicate records, missing values, inconsistent schemas, outdated information, and inaccurate entries that silently reduce the quality of analytics and AI predictions. These hidden data quality issues can lead to poor business decisions, increased operational costs, compliance risks, and unreliable AI outcomes. While most organizations implement basic validation rules, traditional data quality frameworks are largely rule-based, difficult to maintain, and unable to detect complex anomalies that continuously evolve across modern cloud data platforms. This article introduces the Data Trust Score Engine, an AI-powered cloud-native solution designed to automatically measure and improve enterprise data reliability. Instead of relying solely on manual validation or predefined rules, the platform combines metadata intelligence, large-scale analytics, and machine learning to calculate a dynamic Trust Score (0–100) for every dataset. The score is generated by evaluating multiple quality dimensions, including data completeness, consistency, uniqueness, freshness, schema compliance, null-value distribution, statistical anomalies, and AI-detected outliers. As a result, organizations can quickly identify fake, duplicate, corrupted, or low-quality datasets before they impact reporting, business intelligence, or downstream AI models. Learn about Medium’s values The solution is built entirely on Google Cloud Platform (GCP) using BigQuery as the scalable analytical data warehouse, Data Catalog for centralized metadata management and governance, and Vertex AI for intelligent anomaly detection and predictive quality analysis. BigQuery processes billions of records efficie

Intro While building a simple A‑share market monitor for my quant lab work, I initially only cared about extracting obvious metrics: last price, total trading volume, and so on. My naive assumption was that pulling raw JSON from an A‑share real‑time market API and rendering it would finish the job. Once I started running short‑term trading simulation workflows, I realized most actionable insight lives inside structured order‑book data. Level‑2 data is far more than a basic price snapshot. It carries granular bid‑ask tiers plus real‑time order change events. Bad parsing logic will desync your local order book from the real exchange state and mislead your trading simulation decisions. Pain points: Regular market data vs Level‑2 data Standard market APIs return lightweight records built for simple UI display. You mostly get last traded price, total volume, and price change. Level‑2 is designed to reconstruct the full order book. It exposes five‑tier bid/ask prices & volumes, trade direction flags, and order‑update events. You can clearly observe shifts between buying pressure and selling pressure. One common gotcha: A‑share real‑time market APIs don’t follow uniform field naming. Some wrap order tiers inside arrays, others split bids and asks into separate top‑level fields. Without standardized parsing logic, order‑book ratio calculations and strength comparisons will produce wrong results. A typical five‑tier order‑book object includes ticker symbol, bid array, ask array, and timestamp. In my workflow I keep bid‑side and ask‑side processing separate: Bid side : extract best‑bid price and volume, aggregate total buy‑side depth Ask side : extract best‑ask price and volume, assess selling pressure Keeping them isolated makes multi‑side calculations cleaner and speeds up debugging. Efficiency note: Don’t compute directly on raw API payloads I never feed unprocessed Level‑2 raw responses straight into indicator calculations. A normalization step is mandatory. Raw unnormali

How We Cut AWS Staging Costs by 87% With EventBridge Scheduler No code changes. No Lambda functions. No complex scripts. Just 4 schedulers and a realization that nobody uses staging at 3am. Here's a question every engineering team should ask themselves: "When was the last time someone actually used our staging environment at 2am?" For us? Never. Not once. Yet we were paying for it — EC2 running, ECS Fargate tasks spinning, compute burning money — every single hour of every single day, including weekends, holidays, and the 21 hours per day when nobody on our team was even awake. That's the hidden tax of staging environments. And most teams never fix it because the solution feels complicated. It isn't. This is how we cut our staging compute costs by 87.5% — using AWS EventBridge Scheduler, zero Lambda functions, and zero lines of application code. The Problem: Staging Was Running 24/7 For No Reason Our staging environment had two resources running around the clock: EC2 instance — our staging app server ECS Fargate service — our backend API container Our team actively uses staging for roughly 3 hours a day . That's it. The math was embarrassing: Running: 24 hours/day Used: 3 hours/day Wasted: 21 hours/day = 87.5% of compute going nowhere Monthly cost breakdown: EC2 + ECS Fargate (24x7): ~$19.18/month EC2 + ECS Fargate (3hr/day): ~$2.40/month Monthly saving: $16.78 Yearly saving: $201.35 Reduction: 87.5% $201/year saved on staging compute alone — with 45 minutes of setup and zero application code changes. Multiply that across dev environments, QA clusters, review apps, and load test environments. The savings compound fast. The Solution: AWS EventBridge Scheduler Most engineers reach for Lambda when they need to automate AWS tasks on a schedule. That works — but it means writing code, managing runtimes, setting up CloudWatch Logs, and maintaining a function forever. EventBridge Scheduler is the better tool here. It lets you call any AWS SDK action directly on a cron sche

Microsoft has outlined an AI governance architecture spanning nine governance domains and four functions: policy, control, visibility, and proof. The approach connects policies with runtime enforcement, continuous evaluation, observability, identity, security, and audit evidence to help organizations verify governance requirements as AI applications and agents operate in production. By Leela Kumili

Cloudflare recently open-sourced Cloudflare OS. It allows enterprise teams to output work artifacts grounded in enterprise knowledge, know-how, and provisioned connectors, automate repetitive workflows with optimized token cost (with AI assistance only where needed), and build personal, shareable, customizable work software that caters to specific, complex use cases within a secure sandboxed model By Bruno Couriol

The AWS Community Builders program opens applications once a year, typically in early January, and closes within about two weeks. That's a narrow window. If you're serious about the 2027 cycle, you have roughly four months from now to build the contribution track record that gets you selected. I wrote my personal story about getting into the program from Cameroon. This post is different. It's a practical, no-fluff guide covering how the program works, what the application actually asks, what reviewers evaluate (based on patterns from people who've been accepted and rejected), and how to prepare starting today. What the AWS Community Builders Program Actually Is AWS Community Builders is a global program that recognizes people who share AWS knowledge publicly. Not AWS employees. Not necessarily experts. Engineers, students, content creators, and community organizers who consistently write, build, speak, or contribute to open source around AWS services. The key word is consistently . This is not a certification you study for. It's recognition of a public track record of helping others learn and build on AWS. The program sits below the AWS Heroes program in AWS's community ladder. Heroes are veterans with years of visible impact. Community Builders is the accessible entry point, and for most engineers reading this, the realistic first target. It's free to apply. Membership runs in yearly cycles with renewal based on continued activity. The Categories (Pick One That Matches Your Work) When you apply, you select a technology category. For 2026 the categories were: AI Engineering : Building generative AI applications with Amazon Bedrock, prompt engineering, RAG, fine-tuning, agents Cloud Operations : Observability and configuration (CloudWatch, Systems Manager, Config, Service Catalog) Containers : ECS, EKS, Fargate, App Runner Data : Databases and analytics (DynamoDB, RDS, S3, OpenSearch, Redshift, Athena) Dev Tools : CI/CD, CDK, build pipelines, Application Composer Fro

OVHcloud will raise prices from September, with 2026-edition gaming servers up 87 percent and other recent servers 40 to 59 percent. Founder Octave Klaba says memory cost six times more in June than a year earlier, as RAM suppliers shifted capacity toward high-bandwidth memory for AI. AWS, buying years ahead, has repriced one reserved GPU product. By Steef-Jan Wiggers

It’s been a while since I wrote a blog post. Recently, I decided to get back into writing and document something I’ve been playing around with: setting up a small homelab environment on an Oracle Cloud Free Tier VPS. As a software engineer, I’ve always been interested in what happens behind the scenes when an application moves from my laptop to an actual server. Things like networking, deployment, Linux, containers, firewalls, and DNS are all areas I’ve wanted to understand better through actual hands-on experience rather than just reading about them. The fact that I could do all of this on a free VPS made it even better. Why I Started This Experiment I initially set up an Oracle Cloud Free Tier VPS running Ubuntu with: 1 GB RAM 1 vCPU Ubuntu Linux A public IP address I wasn't planning to host anything serious on it. The main goal was simply to use it as a small playground where I could experiment with infrastructure and improve my Linux and system administration skills. Interestingly, the last time I regularly worked with a VPS was probably around seven years ago. Back then, a few friends and I used to rent servers and set up Call of Duty 4 multiplayer servers. We'd spend hours messing around with the server configuration and, of course, playing on it afterwards. Things have changed quite a bit since then. These days, I'm much more interested in software engineering, DevOps, infrastructure, and homelabbing. So I thought it would be fun to take a free VPS and see how much I could actually do with it. First Challenge: K3s on 1 GB of RAM One of the first things I wanted to try was K3s, the lightweight Kubernetes distribution. I wanted to get a basic Kubernetes environment running and use it to experiment with container orchestration. That plan didn't last very long. After installing K3s and starting the server, I noticed the memory usage climbing pretty quickly. With only 1 GB of RAM, there wasn't much room left for anything else. Once I started thinking about running

Cloudflare recently introduced Kitesurf, a lightweight browser built for automated workloads. Kitesurf runs browser components in isolated WebAssembly/Rust environments on Cloudflare Workers and supports the Chrome DevTools Protocol, allowing tools such as Playwright and Puppeteer to drive it with lower resource overhead than a full Chromium browser. By Renato Losio

The cloud ecosystem in 2026 isn't just about moving VMs to the public cloud—it's heavily driven by hybrid operations, unified security telemetry, AI integration, and complex governance across multi-region architectures. As enterprise tech stacks evolve, Microsoft Azure certifications remain a primary yardstick for technical competence, but knowing which track to target is where most engineers get stuck. As someone who works closely with cloud certification blueprints and enterprise deployments, I wanted to map out where Microsoft credentials stand today, what the market actually demands, and how specific exams fit real-world scenarios. Market Trends: Why Azure Credentials Still Drive Real ROI in 2026 The value of certification has shifted from basic feature recognition to proving operational problem-solving under real constraints. Hands-on Scenario Focus: Exams increasingly test scenario-based trade-offs—balancing performance, cost, and strict security requirements rather than simple definition checks. Role-Based Specialization: Instead of broad, generic tracks, Microsoft continues to refine specialized pathways for developers, security analysts, and hybrid infrastructure specialists. Continuous Free Renewal: Earning the badge is step one, but maintaining active status requires passing annual, open-book renewal assessments directly through Microsoft Learn, ensuring skills don't stall out. Mapping Azure Exams to Real-World Enterprise Scenarios Depending on your daily engineering focus or career targets, here is how the core role-based tracks align with active projects: App Modernization & Cloud-Native Dev: AZ-204 (Azure Developer Associate) The Scenario: Refactoring monolithic legacy apps into containerized microservices using Azure App Service, Azure Functions, and Cosmos DB while setting up secure authentication via Microsoft Entra ID. Hybrid Infrastructure & Server Ops: AZ-800 (Administering Windows Server Hybrid Core Infrastructure) The Scenario: Managing mixed e

AWS has released aws-bench, an open-source benchmark for evaluating AI agents on real AWS tasks such as misconfigurations and infrastructure provisioning. Unlike traditional benchmarks, it uses real resources in disposable AWS accounts, scoring agent performance through automated verifiers. By Gianmarco Nalin