Category: Technical How-to

Organizations in regulated industries run container workloads in air-gapped AWS environments, which means migrating hundreds of Helm charts and images into private Amazon ECR with consistent security controls. This post uses Amazon ECR repository creation templates, Terraform, and a migration tool to make secure-by-default the path of least resistance.

The NGINX Ingress Controller is retired. If you run oauth2-proxy with NGINX for OpenID Connect authentication, switching to the AWS Load Balancer Controller can silently break your auth. This post shows two ways to keep OIDC working on an Application Load Balancer: run oauth2-proxy in reverse proxy mode, or use ALB native OIDC.

Learn how to implement dynamic feature flags in Amazon ECS and Amazon EKS using AWS AppConfig with the sidecar pattern. You set up an AWS AppConfig feature flag, deploy the AWS AppConfig Agent as a sidecar container, and toggle application behavior at runtime without rebuilding or redeploying your containers.

Learn how to build an AI-powered migration assessment agent using Amazon Bedrock AgentCore and the Strands Agents SDK. The agent reads application source code and container artifacts, scores Amazon EKS migration readiness, identifies blockers by severity, and generates an actionable migration plan with target architecture recommendations.

A workload spread across three Availability Zones does not necessarily stay spread. This post explains why soft topology spread constraints drift after a node-availability gap, measures the cost, and shows how the Kubernetes descheduler restores even pod distribution on Amazon EKS without downtime and without forcing hard constraints.

An incident is the worst moment to discover you cannot trust your Amazon EKS dashboard. This post shows what a trustworthy single-pane NOC for Amazon EKS on Amazon CloudWatch looks like, why each design choice matters, and how to get one running in your account in about 15 minutes.

Learn how to scope Amazon ECR image pull permissions to individual Kubernetes pods on a multi-tenant Amazon EKS cluster using KEP 4412 credential providers and ECR repository deny policies, so teams sharing the same nodes can pull only their own container images.

Ramp runs GPU-powered AI inference continuously on Amazon ECS. This post walks through how Ramp’s infrastructure team moved those GPU workloads onto Amazon ECS Managed Instances: the architecture pattern, Terraform implementation, and the lessons learned migrating 50 to 60 EC2 instances.

Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure.

Amazon EKS now provides a managed, non-disruptive lifecycle for rotating your cluster’s certificate authority (CA), with automated safeguards and rollback. This deep dive explains how CA rotation works, what AWS handles versus what you must update, and how to walk through the rotation lifecycle on your own timeline.