Ananta

Step-by-step guide for exposing ArgoCD on a K3s cluster with Cloudflare full-strict TLS. Includes using a Cloudflare Origin Certificate with NGINX Ingress, disabling Traefik, Helm installation, creating TLS secrets, configuring ArgoCD Ingress.

This write-up outlines a subdomain-to-root migration for a Ghost CMS instance running in Docker behind Cloudflare Tunnel. The approach relies on edge-level 301 redirects, application-level canonical updates, and proper validation to preserve URL structure and search engine signals.

Ghost was upgraded to version 6.19.1 to address a critical SQL injection vulnerability (CVE-2026-26980) in the Content API. The database migrations required a manual fix because of a prior MySQL to MariaDB migration, and Cloudflare WAF was implemented for additional protection.

I applied to 112 DevOps-related roles to validate my CV and understand market expectations and tracked all outcomes including HR interviews, assessments, user interviews, offers, withdrawals, and ghosting using a Sankey diagram to visualize the flow.

In a multi-node K3s cluster, I deployed OpenObserve using S3 for log storage and PostgreSQL for metadata, with logs collected via OpenTelemetry. Within half a day, I had logs and Kubernetes events flowing into dashboards, with significantly fewer moving parts compared to traditional ELK setups.

Exploring how to use Traefik for routing Docker containers while securely terminating traffic with Cloudflare Full Strict TLS. This PoC demonstrates setting up a clean internal Docker network, connecting multiple services like MinIO, and ensuring requests are routed correctly based on host rules.