Insights for Builders

Postgres spawns one OS process per client connection — expensive, and capped by max_connections. A fleet of application pods, or bursty serverless workloads, exhausts that cap fast. PgBouncer sits in front of Postgres and multiplexes many client connections onto a small pool of real ones. Here's how it works, the three pooling modes, and what actually breaks in transaction mode.

Redis on Kubernetes comes down to one decision made early and hard to reverse later: Sentinel for single-master high availability, or Cluster mode for sharded horizontal scale. Here's what each actually requires operationally, and when self-hosting either beats paying for a managed cache.

terraform test has been built into the CLI since 1.6, and since 1.7 it can mock providers entirely — asserting on plan output without touching a real cloud account. Here's how run blocks, assert blocks, and mock_provider actually work, and where the native framework stops and Terratest still has to take over.

A Kubernetes Secret is base64, not encryption — anyone with repo access can decode it. Sealed Secrets encrypts values asymmetrically before they ever touch git, so only the in-cluster controller can decrypt them. Here's how it works, how it differs from External Secrets Operator, and the key-backup mistake that locks teams out of their own secrets.

No bastion host, no open port 22, no SSH key to lose or rotate. Session Manager gives you a shell on an EC2 instance through the AWS API, with every session optionally logged to S3 or CloudWatch. Here's the IAM and networking setup, and the port-forwarding trick that replaces an SSH bastion entirely.

VPC Lattice connects services across VPCs and accounts at L7 — with built-in IAM auth, weighted traffic shifting, and no sidecars — as a managed alternative to VPC peering or Transit Gateway for service traffic specifically. Here's how Service Networks and Services actually work, how the Kubernetes Gateway API Controller uses it as a data plane, and where it stops and a real service mesh starts.