My signing key for software releases (minisign, key ID 0CDC6DA063220C50): RWRQDCJjoG3cDNBpGGjFdULwyP1xWiSk6MiPBFrWysMlDfVuGvaG13Xz — full verify guide: https://rajesh.medampudi.com/verify

10 hosts with APM on datadog = $460/mo before a single log line. in practice the real bill lands 2-3x that, because they meter hosts hourly and bill the whole month at the peak.

honest annual range: $6k-$18k to know whether your own servers are healthy.

for a small team that's not a rounding error. it's a hire. a junior engineer's quarter, handed to a vendor to tell you your CPU is high.

self-hosting trades it for one fixed cost: S3 + the box it runs on.

https://rajesh.medampudi.com/blog/lgtm-for-small-teams/

#datadog #observability #selfhosting #devops

networkpolicy without a cni that implements it does nothing. the api server accepts your default-deny, enforcement is zero, traffic flows anyway. the silent failure.

test it: two pods, two namespaces, confirm the connection is actually refused. if it isn't refused, your policy is decorative.

https://rajesh.medampudi.com/blog/multi-tenant-infra-small-team

#kubernetes #security #selfhosting #devops

i'll argue for self-hosting observability. but conviction cuts both ways, so: when NOT to.

if you fit grafana cloud's free tier — 10k series, 50GB logs, 50GB traces, 14-day retention, 3 users, $0 — self-hosting buys you nothing. it's a hobby with a pager. use the free tier.

also skip it if nobody will own the upgrades, or if your real problem is compliance retention not cost.

the strongest argument names where it loses.

https://rajesh.medampudi.com/blog/lgtm-for-small-teams/

#selfhosting #observability #grafanacloud #devops

the k8s quota gotcha that bites everyone once: set a cpu/memory quota on a namespace and every new pod must declare requests or limits, or the api server rejects it at admission. tenants suddenly can't deploy and don't know why.

fix: ship a limitrange in the same namespace so pods without requests get sane defaults. quota sets the ceiling, limitrange fills the floor. together or not at all.

https://rajesh.medampudi.com/blog/multi-tenant-infra-small-team

#kubernetes #infrastructure #devops #selfhosting

most teams building multi-tenant k8s skip the only decision that matters: do the tenants trust each other?

yes → namespaces + rbac + quota + default-deny netpol. native, cheap, enough.
no → no amount of yaml fixes a shared api server and a shared kernel. vcluster or separate clusters.

walk it in order, stop at the first "no".

https://rajesh.medampudi.com/blog/multi-tenant-infra-small-team

#kubernetes #selfhosting #infrastructure #devops

ran the 3-year math on one personal box (4 vcpu / 16 gb): ~$195 owned (box + power), ~$972 on hetzner, ~$4,400 on aws.

a $150 n100 pays its hardware back vs the cheapest serious cloud in under 6 months — under 6 weeks vs aws. after that it's ~$15/yr of electricity against $324+/yr of cloud you stopped paying.

the box doesn't just pay for itself. it deletes a recurring bill you were treating as a law of nature.

https://rajesh.medampudi.com/blog/home-colo-lab-pays-for-itself

#selfhosting #homelab #infrastructure

whether to leave the cloud isn't ideology. it's five questions, in order:

bill under ~$2k/mo? traffic spiky? someone who WANTS to own infra? egress or steady compute your biggest cost? can you treat a hardware failure as planned, not invisible?

the first "yes" that points back to the cloud wins. i run bare metal because my workload sits on the far side of all five. most don't.

https://rajesh.medampudi.com/blog/bare-metal-vs-cloud

#infrastructure #kubernetes #selfhosting #devops