https://subhanshumg.com/blogs DevSecOps, platform engineering and cloud security. Long-form essays on the infrastructure that survives production. en Mon, 24 Aug 2026 21:26:10 GMT https://blogs.subhanshumg.com/your-rate-limiter-was-designed-for-humans https://blogs.subhanshumg.com/your-rate-limiter-was-designed-for-humans Mon, 24 Aug 2026 21:26:10 GMT Agent traffic does not get tired. Four layers of your stack assume it does. Devops api Security System Design AI Platform Engineering Cloud Computing https://subhanshumg.com/blogs/prefill-is-compute-decode-is-memory https://subhanshumg.com/blogs/prefill-is-compute-decode-is-memory Fri, 26 Jun 2026 00:00:00 GMT Every LLM request is two workloads with opposite appetites running on one chip. In 2025 the industry quietly stopped sharing the silicon. Here is the architecture, the economics, and the threshold where it pays. LLM Inference GPU Architecture Platform Engineering Systems Design Performance Optimization https://subhanshumg.com/blogs/the-data-plane-is-the-new-perimeter https://subhanshumg.com/blogs/the-data-plane-is-the-new-perimeter Mon, 08 Jun 2026 00:00:00 GMT A reference architecture for AI-native data security: making security a property of the platform, not a feature of the app. Security AI Infrastructure Platform Engineering https://blogs.subhanshumg.com/teefail-broke-confidential-compute https://blogs.subhanshumg.com/teefail-broke-confidential-compute Sun, 24 May 2026 22:34:35 GMT TEE.Fail did not kill confidential compute. It narrowed it. The threat model that excluded physical access stayed safe; the threat model that included it did not. Slatewatch Cyber rebuilt its workload GPU Environment #execution SGX Devops sev-snp gpu tee google cloud software development Security spire Machine Learning https://blogs.subhanshumg.com/the-eu-cra-countdown https://blogs.subhanshumg.com/the-eu-cra-countdown Wed, 20 May 2026 08:37:36 GMT Every product with digital elements sold in the EU after December 2027 must carry a CE conformity assessment. That is the EU CRA. The scope is broader than GDPR. The documentation trail is non-trivial Regulations DevSecOps Devops conformity Security engineering technology EU CRA CEMarking countdown https://blogs.subhanshumg.com/crypto-inventory-the-platform-workstream-nobody-scoped https://blogs.subhanshumg.com/crypto-inventory-the-platform-workstream-nobody-scoped Fri, 15 May 2026 09:06:52 GMT Ironway Materials ran a crypto audit in 2024 and shipped two years of new TLS code on top of it. The 2026 audit found seventeen new libraries, three of them in the hot path, all of them invisible to t crypto PQC Platform Engineering Devops supply chain idp falcon spire #sigstore AWS GCP Azure Security https://blogs.subhanshumg.com/the-agentic-soc-is-here https://blogs.subhanshumg.com/the-agentic-soc-is-here Mon, 11 May 2026 10:38:26 GMT Three vendor agentic-SOC platforms in Q1 2026. One platform-engineering charter that decides whether they work. Microsoft Sentinel AI shipped. Splunk Agentic SOC launched at RSAC. Google SecOps and T agentic-soc agentic AI AI SecOps Security Platform Engineering Devops DevSecOps SOC OpenTelemetry Open Source AWS Cloud https://blogs.subhanshumg.com/the-distributed-monolith-tax https://blogs.subhanshumg.com/the-distributed-monolith-tax Wed, 06 May 2026 03:17:08 GMT We collapsed 47 microservices to 8. Deploy time went up, latency went down, and on-call went silent. Here's what the microservices evangelists didn't tell you about Dunbar's number for services. M DevSecOps System Design monolithic architecture Microservices architecture Devops Kubernetes AWS production ci-cd software development engineering leadership https://blogs.subhanshumg.com/short-lived-oidc https://blogs.subhanshumg.com/short-lived-oidc Sun, 03 May 2026 05:31:09 GMT GitHub OIDC to AWS/GCP/Azure federated credentials killed the need for long-lived PATs in CI. Most orgs still have PATs in use in 2026. Short-lived OIDC is the one-day win. Narrative arc The PAT failu DevSecOps Devops identity-management OIDC GitHub CI/CD owasp Cloud Computing Security spire AWS GCP Artificial Intelligence AI full stack Azure https://blogs.subhanshumg.com/the-50ms-lie https://blogs.subhanshumg.com/the-50ms-lie Mon, 20 Apr 2026 17:25:57 GMT Cloudflare and Fly.io are selling 50ms of latency savings on a 5,000ms inference like it's a revolution. That's 1% of the total latency. You're optimizing the rounding error while paying a 10x penalty edgecomputing AI inference Cloud cloudflare workers Workers AI Devops Machine Learning https://blogs.subhanshumg.com/stop-building-agents-like-prompts-build-them-like-state-machines https://blogs.subhanshumg.com/stop-building-agents-like-prompts-build-them-like-state-machines Sun, 19 Apr 2026 09:48:30 GMT Github repo: https://github.com/SubhanshuMG/agents-as-state-machines The thesis in one paragraph Stop calling them agents. They are state machines that invoke LLMs at certain transitions. The multi-a agentic AI agents state-machines temporal langgraph #llmops Devops Developer SRE System Design https://blogs.subhanshumg.com/forgekit https://blogs.subhanshumg.com/forgekit Tue, 24 Mar 2026 16:30:51 GMT https://github.com/SubhanshuMG/ForgeKit The Problem Nobody Talks About Honestly It is 9 AM on a Monday. Your team just got greenlit on a new microservice. You spin up a fresh repo and then spend the Open Source cli devtools TypeScript Web Development serverless AWS Devops General Programming JavaScript Python vite https://blogs.subhanshumg.com/building-a-deployment-health-validator https://blogs.subhanshumg.com/building-a-deployment-health-validator Tue, 10 Mar 2026 19:52:12 GMT A deep-dive into microservice health checking, topological startup ordering and why HTTP 200 does not mean a service is healthy. The Incident Picture this: your on-call rotation fires a PagerDuty ale Devops Platform Engineering Python Microservices Security https://blogs.subhanshumg.com/platform-engineering-at-the-edge https://blogs.subhanshumg.com/platform-engineering-at-the-edge Tue, 03 Mar 2026 10:30:39 GMT No Internal Developer Platform today supports disconnected edge environments. Backstage, Port, and Cortex all assume always-on cloud connectivity, yet organizations like GE HealthCare (100+ hospital-e Platform Engineering Kubernetes Devops Security edgecomputing gitops https://blogs.subhanshumg.com/governing-the-ungovernable https://blogs.subhanshumg.com/governing-the-ungovernable Sat, 28 Feb 2026 07:04:29 GMT The EU AI Act's risk management requirements for high-risk AI systems are now on the clock. August 2, 2026 is the hard deadline for Annex III systems. But nobody has published a practical technical im euaiact agentic AI ai compliance certification DevSecOps llm Security AI Governance langgraph mlops generative ai #AIAct2026 Article9 https://blogs.subhanshumg.com/the-3am-problem-why-on-call-burnout-is-a-system-design-failure-not-a-people-problem https://blogs.subhanshumg.com/the-3am-problem-why-on-call-burnout-is-a-system-design-failure-not-a-people-problem Wed, 25 Feb 2026 10:04:36 GMT The Human Story Behind the Pager Meet Priya. Senior backend engineer with 5 years of experience, joined a fintech scale-up to build payment infrastructure. She is good at her job. Then she went on-cal Devops SRE Kubernetes #AIOps backend https://blogs.subhanshumg.com/xz-utils-backdoor-sbom-supply-chain-security https://blogs.subhanshumg.com/xz-utils-backdoor-sbom-supply-chain-security Sun, 22 Feb 2026 15:05:20 GMT The XZ Utils backdoor (CVE-2024-3094) nearly became the most devastating supply chain attack in history; a patient, three-year social engineering campaign that embedded a remote code execution backdoo supply chain Security DevSecOps sbom Kubernetes Platform Engineering Open Source cybersecurity GitHub github-actions CVE internal developer platforms https://blogs.subhanshumg.com/the-global-cloud-blackout https://blogs.subhanshumg.com/the-global-cloud-blackout Tue, 17 Feb 2026 13:51:01 GMT If AWS disappeared tomorrow, would your company survive? Not degraded. Not slow. Gone. Most "highly available" systems would collapse within hours. This isn't fear-mongering. It's an architectural re Cloud architecture Disaster recovery SRE Devops Terraform Chaos Engineering high availability System Design multi-cloud Kubernetes https://blogs.subhanshumg.com/how-attackers-bypass-your-compliant-cicd-pipeline-and-how-to-redesign-it https://blogs.subhanshumg.com/how-attackers-bypass-your-compliant-cicd-pipeline-and-how-to-redesign-it Sun, 08 Feb 2026 23:43:21 GMT Modern CI/CD pipelines are often treated as untouchable “trusted builds” – locked down by code review and best practices but that trust is a myth. A pipeline is a prime attack surface, containing ever Devops cybersecurity Cloud Security Platform Engineering supply chain cicd Kubernetes technology github-actions https://blogs.subhanshumg.com/the-zero-dollar-compliance-stack https://blogs.subhanshumg.com/the-zero-dollar-compliance-stack Mon, 26 Jan 2026 20:38:25 GMT The Lie We’re All Sold “You need expensive GRC tools to pass enterprise audits.” Reality: Auditors don’t care about tools They care about controls, traceability and evidence Compliance ≠ Softwar Devops audit compliance ISO 27001 PCI DSS Cloud Security System Design https://blogs.subhanshumg.com/secrets-are-a-supply-chain https://blogs.subhanshumg.com/secrets-are-a-supply-chain Fri, 23 Jan 2026 14:32:43 GMT Everyone rotates secrets. Very few design secret lifecycle risk and that gap is where breaches live. Most organizations believe secret rotation equals security. It doesn’t. Rotation is a maintenance cybersecurity Devops Security secrets Supply Chain Management architecture leadership https://blogs.subhanshumg.com/iso-27001 https://blogs.subhanshumg.com/iso-27001 Wed, 21 Jan 2026 08:20:08 GMT “We passed an ISO-27001 surveillance audit with zero Jira tickets, zero screenshots, and zero manual evidence.” That line usually gets silence. Then disbelief. Then the real question: “Okay… how?” Devops audit ISO 27001 compliance automation AWS ci-cd Security https://blogs.subhanshumg.com/beyond-the-kernel https://blogs.subhanshumg.com/beyond-the-kernel Sun, 09 Nov 2025 17:00:42 GMT Security no longer lives outside the system. It lives within the kernel. In a world of microservices, containers, and ephemeral workloads, traditional observability tools see only what applications ex eBPF DevSecOps cloud native Kubernetes Security falco cilium AWS Linux Kernel monitoring observability zerotrust https://blogs.subhanshumg.com/devsecops-for-the-mind https://blogs.subhanshumg.com/devsecops-for-the-mind Sun, 31 Aug 2025 19:26:40 GMT Introduction Developers build systems. DevSecOps engineers build secure, automated pipelines.But what happens when you apply the same principles to your own life and knowledge? Over the last year, I’v DevSecOps cognitive Futureofwork KnowledgeManagement secondbrain pkm Artificial Intelligence collective thinking zerotrust Security https://blogs.subhanshumg.com/deploying-a-bitcoin-regtest-network-with-docker-and-cicd-tools https://blogs.subhanshumg.com/deploying-a-bitcoin-regtest-network-with-docker-and-cicd-tools Sat, 23 Aug 2025 08:17:11 GMT Hands-on + R&D guide. We’ll stand up a private Bitcoin regtest network with two nodes, peer them, mine spendable coins and send/confirm transactions; wrapped in a clean repo with CI and an optional de Bitcoin Devops Docker Blockchain engineering SRE cicd observability Open Source https://blogs.subhanshumg.com/gitlab-import-export-toolkit https://blogs.subhanshumg.com/gitlab-import-export-toolkit Wed, 30 Jul 2025 21:30:09 GMT “I’m a DevOps engineer - if I’m doing it manually twice, I’m writing a script.” A few weeks ago, I was handed a deceptively simple‑sounding task: spin up an entire playground environment, pipelines, Devops GitLab automation Scripting Python ci-cd migration Cloud Branching Strategies engineering vcs Open Source https://blogs.subhanshumg.com/rasp-integration https://blogs.subhanshumg.com/rasp-integration Tue, 24 Jun 2025 06:53:34 GMT Introduction Runtime Application Self-Protection (RASP) embeds security within running applications and can report attacks in real-time. By integrating RASP into CI/CD pipelines, production threat int SelfHealingSecurity Devops cicd rasp Application Security runtime-security automation Security infosec ThreatDetection https://blogs.subhanshumg.com/mastering-traefik-as-a-dynamic-reverse-proxy-for-containerized-environments https://blogs.subhanshumg.com/mastering-traefik-as-a-dynamic-reverse-proxy-for-containerized-environments Sun, 18 May 2025 22:28:48 GMT Introduction In modern microservices and containerized ecosystems, Traefik serves as a powerful reverse proxy, offering dynamic service discovery, advanced routing capabilities and automated SSL/TLS m Docker Traefik routing Security TLS scalability Cloud Computing proxy #IaC containerization https://blogs.subhanshumg.com/building-agentic-rag-systems-devsecops-blueprint-for-autonomous-and-secure-ai https://blogs.subhanshumg.com/building-agentic-rag-systems-devsecops-blueprint-for-autonomous-and-secure-ai Tue, 22 Apr 2025 23:39:23 GMT Introduction: Why Agentic RAG is the Next Frontier Retrieval-Augmented Generation (RAG) revolutionized LLMs by grounding them in external data. But static, one-shot retrieval struggles with dynamic, m RAG agentic AI AI Security observability policy as code compliance Kubernetes DevSecOps cloud native mlops https://blogs.subhanshumg.com/end-to-end-cloud-native-deployment https://blogs.subhanshumg.com/end-to-end-cloud-native-deployment Tue, 15 Apr 2025 21:22:03 GMT Introduction This technical walkthrough demonstrates how to deploy a secure, scalable microservice on AWS using infrastructure-as-code (Terraform), containerization (Docker), and serverless computing AWS Terraform Docker ECS aws-fargate Devops serverless Security zerotrust scalability technology community innovation https://blogs.subhanshumg.com/caching-conundrum https://blogs.subhanshumg.com/caching-conundrum Mon, 14 Apr 2025 16:21:15 GMT Caching involves storing duplicates of frequently accessed data at various points along the request-response path. When a consumer seeks a resource like a YouTube video, the request traverses one or m api caching optimization Redis Devops performance System Design innovation scalability software development https://blogs.subhanshumg.com/micro-segmentation-strategies-in-devsecops https://blogs.subhanshumg.com/micro-segmentation-strategies-in-devsecops Sun, 23 Mar 2025 14:42:10 GMT Introduction Traditional perimeter security is no longer sufficient in today’s dynamic and threat-laden IT environments. Micro-segmentation: The process of dividing your network into granular zones en microsegmentation Kubernetes DevSecOps zerotrust cloudsecurity Security #infosec ci-cd architecture https://blogs.subhanshumg.com/designing-scalable-secure-systems-w-devsecops https://blogs.subhanshumg.com/designing-scalable-secure-systems-w-devsecops Sun, 02 Mar 2025 21:22:03 GMT In the fast-evolving landscape of modern application development, building scalable, high-performance systems demands more than just robust code it calls for a thoughtful blend of system design, opera DevSecOps System Design scalability Security Microservices concurrency multithreading cicd APIs performance infrastructure Cloud architecture AWS Kubernetes https://blogs.subhanshumg.com/unikernel-containers https://blogs.subhanshumg.com/unikernel-containers Tue, 28 Jan 2025 11:39:40 GMT Introduction In a rapidly evolving technological landscape, where agility and security are paramount, unikernel containers are emerging as a revolutionary force in DevSecOps. These ultra-lightweight c DevSecOps unikernel cicd containers innovation Security revolution technology operating system virtualization Linux https://blogs.subhanshumg.com/the-power-of-rootless-docker-containers https://blogs.subhanshumg.com/the-power-of-rootless-docker-containers Mon, 20 Jan 2025 19:40:23 GMT In the rapidly evolving world of DevSecOps, ensuring secure deployments is more critical than ever. Enter Docker rootless containers, a groundbreaking solution designed to enhance container security b RootlessDocker DevSecOps Docker containersecurity #cybersecurity cloudsecurity compliance cicd Linux advanced https://blogs.subhanshumg.com/container-networking-security-with-traefik https://blogs.subhanshumg.com/container-networking-security-with-traefik Thu, 16 Jan 2025 13:49:55 GMT Introduction Container networking security is a cornerstone of modern microservices architecture. Tools like Traefik and Docker Compose simplify orchestration and networking, but implementing advanced Microservices cloud security Traefik Devops Portainer elk-stack Grafana #prometheus #multitenancy mTLS Docker compose containerization containers https://blogs.subhanshumg.com/serverless-20-hybrid-decentralized-frameworks-for-stateless-compute https://blogs.subhanshumg.com/serverless-20-hybrid-decentralized-frameworks-for-stateless-compute Thu, 02 Jan 2025 10:40:14 GMT Introduction In the age of cloud computing, serverless architectures have become synonymous with scalability, cost-efficiency, and operational simplicity. However, these advantages often come with a c serverless decentralization Devops Hybrid Cloud Blockchain StateLESS ipfs filecoin Smart Contracts innovation Resilience Cloud computing akash network https://blogs.subhanshumg.com/the-future-of-devsecops https://blogs.subhanshumg.com/the-future-of-devsecops Sat, 21 Dec 2024 15:50:37 GMT In today’s hyper-connected world, building software often involves diverse, distributed teams collaborating across multiple organizations. Traditional DevSecOps pipelines rely on centralized tools and DevSecOps decentralization cicd AI Smart Contracts immutable infrastructure Security Trustless automation #cybersecurity https://blogs.subhanshumg.com/architecture-design-for-automated-rolling-updates-of-node-operator-docker-images https://blogs.subhanshumg.com/architecture-design-for-automated-rolling-updates-of-node-operator-docker-images Tue, 10 Dec 2024 06:13:41 GMT Components Docker Registry Monitoring: Uses a webhook or polling mechanism to detect new releases of the bitscrunch:latest image. Integrates with a CI/CD pipeline to automate the update process. A Docker automation DevSecOps kafka architecture node Grafana Monitoring Kubernetes https://blogs.subhanshumg.com/ensuring-inter-agent-data-integrity-in-multi-node-devsecops https://blogs.subhanshumg.com/ensuring-inter-agent-data-integrity-in-multi-node-devsecops Sat, 30 Nov 2024 08:30:03 GMT Introduction In modern DevSecOps environments, where distributed systems and multi-node architectures are prevalent, ensuring data integrity during inter-agent communication is crucial. Compromised da MultiNodeArchitecture SecuringData MITMPrevention Cryptography DevSecOps #cybersecurity Hashing TLS Resilience #dataintegrity https://blogs.subhanshumg.com/federated-learning-for-distributed-mlops-security https://blogs.subhanshumg.com/federated-learning-for-distributed-mlops-security Sun, 17 Nov 2024 00:52:04 GMT Introduction As Machine Learning Operations (MLOps) scale across industries, safeguarding sensitive data while enabling distributed training becomes a significant challenge. Enter Federated Learning ( pysyft smpc federated learning mlops distributed system Kubernetes #prometheus elk DevSecOps Datadog flower HPA Deep Learning https://blogs.subhanshumg.com/accelerating-deployment-velocity-reducing-build-times-and-image-sizes-in-kubernetes https://blogs.subhanshumg.com/accelerating-deployment-velocity-reducing-build-times-and-image-sizes-in-kubernetes Tue, 29 Oct 2024 04:22:09 GMT Introduction Welcome to the final part of my Kubernetes CI/CD optimization series!So far, we’ve covered the essentials of Kubernetes deployment, container image optimization, and strategies for speedi Kaniko Kubernetes optimization DevSecOps Devops Microservices Docker containerization Continuous Integration continuous deployment cloud native automation #IaC SRE https://blogs.subhanshumg.com/securing-kubernetes-operations-with-runtime-security-best-practices https://blogs.subhanshumg.com/securing-kubernetes-operations-with-runtime-security-best-practices Tue, 22 Oct 2024 03:46:21 GMT Welcome to the 9th installment of my Kubernetes series wherw we’ll dive into advanced runtime security techniques for Kubernetes environments to detect anomalies, enforce strict container security pol Kubernetes #cybersecurity containerization Orchestration cloudsecurity falco sysdig aquasec cloudops DevSecOps runtime Security https://blogs.subhanshumg.com/picking-the-right-load-balancer-for-your-kubernetes-environment https://blogs.subhanshumg.com/picking-the-right-load-balancer-for-your-kubernetes-environment Thu, 17 Oct 2024 16:50:08 GMT Introduction As Kubernetes adoption skyrockets, managing traffic within and to your clusters becomes a critical aspect of ensuring availability, performance, and scalability. One of the most important Load Balancing nginx Devops SecOps ingress Traefik Microservices cloudnative AWS Kubernetes EKS https://blogs.subhanshumg.com/designing-an-effective-fallback-plan-for-kubernetes-failures https://blogs.subhanshumg.com/designing-an-effective-fallback-plan-for-kubernetes-failures Thu, 10 Oct 2024 19:42:38 GMT Welcome to Part VII of my Kubernetes series, where we’ll explore the essential strategies for building a robust disaster recovery and fallback plan for your Kubernetes workloads. In this article we'll Disaster recovery Kubernetes Devops AWS dns failover velero Backup scalability multicloud replication route53 kubefed Helm https://blogs.subhanshumg.com/leveraging-caching-cdn-and-rate-limiting-to-enhance-kubernetes-performance https://blogs.subhanshumg.com/leveraging-caching-cdn-and-rate-limiting-to-enhance-kubernetes-performance Sun, 06 Oct 2024 19:29:21 GMT Welcome to Part VI of my Kubernetes series! In this post, we’re diving deep into three powerful techniques: caching, Content Delivery Networks (CDNs), and rate limiting that can significantly boost th Kubernetes cloudflare ratelimit CDN caching performance Microservices Redis Devops cloudnative scalability SRE System Architecture https://blogs.subhanshumg.com/understanding-composite-sla-calculations-in-kubernetes-systems https://blogs.subhanshumg.com/understanding-composite-sla-calculations-in-kubernetes-systems Fri, 04 Oct 2024 18:35:14 GMT Welcome to Part V of my Kubernetes series! In this installment, we’re going to explore the complex yet crucial process of calculating the Composite Service Level Agreement (SLA) for distributed applic sla sli Devops Kubernetes caching CDN distributed system Performance Optimization Microservices SRE ratelimit containerization https://blogs.subhanshumg.com/ensuring-pci-dss-popi-gdpr-and-hipaa-compliance-in-kubernetes-systems https://blogs.subhanshumg.com/ensuring-pci-dss-popi-gdpr-and-hipaa-compliance-in-kubernetes-systems Wed, 02 Oct 2024 15:52:18 GMT Introduction Welcome to Part IV of my Kubernetes series, where we delve into building compliant systems on Kubernetes to meet stringent regulatory standards such as PCI-DSS, POPI, GDPR, and HIPAA. As pcidss HIPAA rbac #istio Kubernetes compliance #gdpr openpolicyagent DevSecOps cloud native #cybersecurity #DataProtection https://blogs.subhanshumg.com/optimizing-costs-for-cloud-architectures-with-kubernetes-workloads https://blogs.subhanshumg.com/optimizing-costs-for-cloud-architectures-with-kubernetes-workloads Mon, 30 Sep 2024 17:05:40 GMT In this III part of my Kubernetes series, we will dive deep into Cost Estimation for Cloud Architectures, focusing on practical strategies for managing the cost of running Kubernetes workloads in clou Devops Kubernetes #prometheus Grafana Cloud Computing savings finops HPA Microservices Kubecost AWS Azure GCP autoscaling technology https://blogs.subhanshumg.com/tweaking-kubernetes-deployments-for-enhanced-backward-compatibility https://blogs.subhanshumg.com/tweaking-kubernetes-deployments-for-enhanced-backward-compatibility Sun, 29 Sep 2024 15:46:28 GMT Welcome to Part II of my Kubernetes series, where we explore how to Master Kubernetes Deployments for Seamless Backward Compatibility. Managing Kubernetes upgrades can be tricky, especially when you n Canary deployment Devops cloudnative containerization Microservices Blue/Green deployment APIs backward compatibility Kubernetes Security