Hi, I'm Thi.
DevOps, SRE & Cloud Architecture
Journal.
Personal technical writing about Kubernetes, n8n automation, cloud infrastructure, security boundaries, and the small production decisions that matter in high-scale environments.
Building a Secure Webhook Gateway for Private n8n
Exposing your automated workflow engine to the public internet creates an immediate, unnecessary attack surface. Here is how we enforce end-to-end payload integrity: routing high-throughput Slack and external triggers through a Cloudflare Worker edge HMAC filter and Cloudflare Zero Trust Tunnel straight into an isolated VPC Kubernetes cluster.
Public Webhook Origin
Slack / GitHub / Third-party API
Cloudflare Edge (WAF + Worker)
HMAC-SHA256 Sig Check • Rate Limiting • IP Geofence
Zero Trust Encrypted Tunnel
Outbound-Only WireGuard protocol
Private n8n Engine
Isolated k8s Pod • Non-root • Read-only FS
Engineering Archives & Research
Zero theoretical filler. Production postmortems, architecture patterns, and reproducible infrastructure setups.
MCPJungle: One Gateway for All My MCP Servers
Moving away from fragmented JSON configurations duplicated across Claude Desktop, Cursor, and Codex CLI. How to deploy a centralized, self-hosted proxy with RBAC, scoped API tokens, and zero-trust logging.
Karpenter with AWS EKS: Just-in-Time Auto-Provisioning
Benchmarking Karpenter against traditional Cluster Autoscaler node groups. Deep dive into instance type diversity, rapid bin-packing calculations, and handling Spot EC2 interruptions without degraded pods.
Create & Manage Clusters with Cluster API & ArgoCD
Deploying multi-region production Kubernetes infrastructure from a unified Git commit. Integrating declarative CAPI manifests with ArgoCD continuous synchronization workflows.
Helm Library Charts and Helm Unit Test Patterns
Architecting reusable boilerplate across 40+ internal microservices without code drift. Writing rigorous unit test suites in CI pipelines to validate edge-case template renderings before deploy.
Kubernetes Multicluster with Kind and Cilium eBPF
Local multicluster lab orchestration using Kind and Cilium ClusterMesh. Dissecting eBPF packet routing, service discovery across cluster borders, and avoiding iptables connection tracking overhead.
eBPF Observability at Scale: Eliminating Sidecar Overhead
Extracting L7 application metrics without injecting Envoy proxies. Benchmarking CPU cycle recovery on high-density node pools.
What I Write About
Kubernetes
AWS EKS, Karpenter just-in-time provisioning, Cilium CNI, GitOps rollouts, and multi-tenant isolation.
Automation
Self-hosted n8n pipelines, ChatOps bots, internal developer platforms, and secure webhook gateways.
AI Tooling
Model Context Protocol (MCP) gateways, agent sandboxes, RBAC credential handling, and local inference infra.
Cloud Security
Ingress perimeter control, Cloudflare WAF, mutual TLS (mTLS), secrets rotation, and hardening VPC topologies.
Engineering Notes
Real-world incident retro postmortems, migration war stories, kernel-level troubleshooting, and runbooks.
Dinh Do Ba Thi
verifiedSenior DevOps & Site Reliability Engineer
Operating high-concurrency cloud infrastructure, distributed Kubernetes clusters, and automated developer platforms.
Deep Technical Transmissions to Your Inbox
No generic product digests, zero promotional spam. Sent once a month: deep architectural postmortems, verified Kubernetes manifest patterns, and production telemetry tips.